kz-proxy: run a subprocess with masked secrets and an HTTP proxy that rewrites tokens.
The main type is [Sandbox]: build it from a [SandboxConfig] (with optional [SecretMapping]s,
[StringMapping]s, and connection allow/deny rules), then call [Sandbox::run] to execute a shell
command with masked env vars and proxied HTTP that rewrites tokens to real secrets.
The proxy is implemented with the hyper stack so that HTTP parsing, Content-Length, chunked encoding, and CONNECT tunneling follow RFC 7230/9110.