[client] Add nblink, an unprivileged forwarder into the network (#7955)

Reaching an internal service meant installing the agent, which needs root
for a TUN device. nblink runs the embedded client in netstack mode and
forwards local HTTP listeners to upstreams inside the tunnel, so it works on
managed machines and in rootless containers. Upstream names resolve
in-process.

Forwards bind loopback unless --allow-public-bind is given. The listener
refuses rebound and cross-site browser requests and bounds stalled request
bodies. It ships as release archives and a distroless image that runs under
an arbitrary UID.

An embedded client given no StatePath now keeps its state in memory rather
than falling back to the installed agent's state file, which every embedded
client in a proxy process also shared. The state manager gets an explicit
in-memory store for it.

e2e/harness/proxy.go

@@ -242,6 +242,13 @@ func (p *Proxy) DebugClients(ctx context.Context) ([]ProxyDebugClient, error) {
 	return resp.Clients, nil
 }
 
+// CACertPath returns the host path of the self-signed certificate the proxy
+// serves for the agent-network endpoint. A client that verifies TLS properly —
+// nblink does, where the curl helpers pass -k — needs it in its trust store.
+func (p *Proxy) CACertPath() string {
+	return filepath.Join(p.workDir, "tls.crt")
+}
+
 // Logs returns the proxy container logs, for diagnostics on failure.
 func (p *Proxy) Logs(ctx context.Context) string {
 	return containerLogs(ctx, p.container)