Full proxy configuration forwarded to the sandbox server as-is (snake_case
so it's wire-compatible with the backend). Mirrors the server's
ProxyConfig type.
interface SandboxProxyConfigAllow/deny list enforced at the proxy sidecar.
Hosts that bypass the proxy entirely.
Header-injection rules keyed by host pattern.