feat: implement selective MITM with configurable domain allowlist in aibridgeproxyd (#21473)

## Description

Implements selective MITM (Man-in-the-Middle) in `aibridgeproxyd` so
that only requests to allowlisted domains are intercepted and decrypted.
Requests to all other domains are tunneled directly without decryption.

## Changes

* New config option: `CODER_AIBRIDGE_PROXY_DOMAIN_ALLOWLIST` (default:
`api.anthropic.com`,`api.openai.com`)
* Selective MITM: Uses `goproxy.ReqHostIs()` to only intercept `CONNECT`
requests to allowlisted hosts
* Certificate caching: Now only generates/caches certificates for
allowlisted domains
* Validation: Startup fails if domain allowlist is empty or contains
invalid entries

Closes: https://github.com/coder/internal/issues/1182

cli/testdata/server-config.yaml.golden

@@ -787,6 +787,13 @@ aibridgeproxy:
   # Path to the CA private key file for AI Bridge Proxy.
   # (default: <unset>, type: string)
   key_file: ""
+  # Comma-separated list of domains for which HTTPS traffic will be decrypted and
+  # routed through AI Bridge. Requests to other domains will be tunneled directly
+  # without decryption.
+  # (default: api.anthropic.com,api.openai.com, type: string-array)
+  domain_allowlist:
+    - api.anthropic.com
+    - api.openai.com
 # Configure data retention policies for various database tables. Retention
 # policies automatically purge old data to reduce database size and improve
 # performance. Setting a retention duration to 0 disables automatic purging for