[proxy] Exercise target access through container E2E (#8117)

Verify access decisions through real management and proxy containers, including upstream delivery and denial. Cover inherited auth, bypass/block, precedence, credential stripping, updates, restrictions, deletion, and private-service rejection.

Validation: container E2E and scoped lint passed locally. The workflow builds both components from the checkout.

.github/workflows/reverse-proxy-e2e.yml

@@ -0,0 +1,53 @@
+name: Reverse Proxy E2E
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/reverse-proxy-e2e.yml'
+      - '**/*.go'
+      - 'e2e/**'
+      - 'shared/management/**'
+      - 'combined/Dockerfile*'
+      - 'proxy/Dockerfile*'
+      - '.dockerignore'
+      - 'go.mod'
+      - 'go.sum'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  reverse-proxy:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Install Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version-file: go.mod
+
+      - name: Set up Buildx
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+
+      - name: Cache Docker layers
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: /tmp/.reverse-proxy-buildx-cache
+          key: ${{ runner.os }}-reverse-proxy-e2e-${{ hashFiles('go.sum', 'combined/Dockerfile.multistage', 'proxy/Dockerfile.multistage') }}
+          restore-keys: |
+            ${{ runner.os }}-reverse-proxy-e2e-
+
+      - name: Run reverse-proxy E2E
+        env:
+          NB_E2E_BUILDX_CACHE: /tmp/.reverse-proxy-buildx-cache
+        run: go test -tags e2e -timeout 25m -v ./e2e/reverseproxy/...