container: Implement setEgressHttp for containers

[gabivlj]

Continuation of: #5939
The main implementation of container-client.c++ has been mostly navigated through Claude Opus 4.5.

We are implementing a HTTP CONNECT service in Workerd that intercepts all TCP traffic off the container thanks to https://hub.docker.com/r/cloudflare/proxy-everything.

We then check configured mappings of the container, if the targetted host exists in the mappings, we redirect to that subrequest channel. If not, we check if enabledInternet is set to true, which then we just connect directly to the internet. If set to false, we just close the connection.

[gabivlj]

builds are failing because proxy-everything is not being pulled by default, I will check if we can pull it when we try to start it

[codspeed-hq]

Merging this PR will not alter performance

✅ 70 untouched benchmarks
⏩ 129 skipped benchmarks¹

---

_{Comparing gv/set-egress-binding-pr (1cad4a3) with main (fc6ae8f)}

Footnotes

1. 129 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[codecov-commenter]

Codecov Report

❌ Patch coverage is 2.75862% with 282 lines in your changes missing coverage. Please review.
✅ Project coverage is 69.99%. Comparing base (fc6ae8f) to head (1cad4a3).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
src/workerd/server/container-client.c++	0.00%	249 Missing ⚠️
src/workerd/api/container.c++	0.00%	22 Missing ⚠️
src/workerd/server/server.c++	42.10%	10 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5985      +/-   ##
==========================================
- Coverage   70.17%   69.99%   -0.18%     
==========================================
  Files         407      407              
  Lines      107238   107518     +280     
  Branches    17985    18025      +40     
==========================================
+ Hits        75251    75254       +3     
- Misses      21196    21472     +276     
- Partials    10791    10792       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[kentonv]

I've only looked at the interfaces so far. Happy to trust Dan's review of implementation details.

[github-actions]

The generated output of @cloudflare/workers-types has been changed by this PR. If this is intentional, run just generate-types to update the snapshot. Alternatively, you can download the full generated types:

Full Type Diff

diff -r types/generated-snapshot/experimental/index.d.ts bazel-bin/types/definitions/experimental/index.d.ts
3844c3844,3845
<   setEgressHttp(addr: string, binding: Fetcher): void;
---
>   interceptOutboundHttp(addr: string, binding: Fetcher): Promise<void>;
>   interceptAllOutboundHttp(binding: Fetcher): Promise<void>;
diff -r types/generated-snapshot/experimental/index.ts bazel-bin/types/definitions/experimental/index.ts
3853c3853,3854
<   setEgressHttp(addr: string, binding: Fetcher): void;
---
>   interceptOutboundHttp(addr: string, binding: Fetcher): Promise<void>;
>   interceptAllOutboundHttp(binding: Fetcher): Promise<void>;