feat: implement RFC 0009 phase 1 supervisor middleware

[pimlock]

Description

Implement RFC 0009 Phase 1: proto-backed, policy-selected, in-process supervisor HTTP egress middleware for HttpRequest/pre_credentials.

This phase should establish the first reviewable implementation seam without depending on external middleware processes or gateway-wide registration.

Context

Parent feature issue: #1733

Phase 1 covers:

• openshell.middleware.v1 protobuf contract for supervisor middleware.
• Sandbox policy schema and validation for global, policy-level, and endpoint-level middleware attachments.
• In-process supervisor middleware chain execution with fail-closed defaults and explicit fail-open support.
• Safe append-only header mutation and request-body transformation before credential injection.
• Built-in openshell/secrets regex redactor for common API key and secret patterns.
• Supervisor network relay integration for declared L7 endpoints and parsed passthrough HTTP credential relay.
• OCSF/audit seams that record allow, deny, transform, failure, and finding outcomes without raw payload data.

Out of scope for this phase:

• External gRPC middleware service invocation.
• Gateway middleware registration and discovery.
• mTLS/auth between supervisor and external middleware.
• Runtime CLI middleware management.
• openshell/sigv4.

Definition of Done

• proto/middleware.proto defines the v1 service and messages used by Phase 1 and later phases.
• Policy YAML/proto round trips preserve middleware configs and attachments.
• Policy validation rejects invalid/missing middleware refs, invalid names, invalid on_error, unsafe openshell/ implementation names, and middleware on tls: skip endpoints.
• Supervisor middleware chain tests cover allow, deny, transform, metadata, findings, unsafe headers, fail-open, and fail-closed behavior.
• Relay integration tests cover no-middleware behavior, redaction before credential injection, denial short-circuiting, passthrough HTTP inspection, and WebSocket upgrade request inspection.
• OCSF tests assert event class/severity and absence of raw sensitive payload material.