feat: implement selective MITM with configurable domain allowlist in aibridgeproxyd (#21473)

## Description

Implements selective MITM (Man-in-the-Middle) in `aibridgeproxyd` so
that only requests to allowlisted domains are intercepted and decrypted.
Requests to all other domains are tunneled directly without decryption.

## Changes

* New config option: `CODER_AIBRIDGE_PROXY_DOMAIN_ALLOWLIST` (default:
`api.anthropic.com`,`api.openai.com`)
* Selective MITM: Uses `goproxy.ReqHostIs()` to only intercept `CONNECT`
requests to allowlisted hosts
* Certificate caching: Now only generates/caches certificates for
allowlisted domains
* Validation: Startup fails if domain allowlist is empty or contains
invalid entries

Closes: https://github.com/coder/internal/issues/1182

coderd/apidoc/docs.go

@@ -12055,6 +12055,12 @@ const docTemplate = `{
                 "cert_file": {
                     "type": "string"
                 },
+                "domain_allowlist": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
                 "enabled": {
                     "type": "boolean"
                 },

coderd/apidoc/swagger.json

@@ -10716,6 +10716,12 @@
 				"cert_file": {
 					"type": "string"
 				},
+				"domain_allowlist": {
+					"type": "array",
+					"items": {
+						"type": "string"
+					}
+				},
 				"enabled": {
 					"type": "boolean"
 				},