[repo-assist] Fix NO_PROXY wildcard bypass entries not matching subdomains

[github-actions]

🤖 This is an automated fix from Repo Assist, an AI assistant.

Closes #3548

Root cause

envProxies() in src/Paket.Core/Common/NetUtils.fs built the NO_PROXY bypass regex by:

1. Calling Regex.Escape on the entire NO_PROXY string.
2. Then calling .Replace("*", ".*") to turn wildcard entries into a valid regex wildcard.

But step 1 already turns a literal * into the escaped sequence \*, so step 2's Replace("*", ".*") never finds a bare * to replace — it silently no-ops. The result is that a NO_PROXY entry like *.internal.company.com was compiled into the bypass list as the literal (non-wildcard) pattern \*\.internal\.company\.com, which will essentially never match a real hostname. This meant users with wildcard/domain-suffix entries in NO_PROXY/no_proxy had their proxy bypass silently ignored — exactly the symptom reported in #3548.

Fix

Split each comma-separated NO_PROXY entry on * first, Regex.Escape only the literal segments, then rejoin with .*. This produces a proper regex (e.g. .*\.internal\.company\.com) consistent with how System.Net.WebProxy.BypassList semantics are documented and how the existing non-wildcard test cases already expected escaping to behave.

Trade-offs

• Minimal, surgical change confined to the bypass-list construction; no behavioral change for non-wildcard entries.
• Updated one pre-existing test assertion (UtilsSpecs.fs) whose expected value encoded the buggy output ("(redacted)*\\.asdf\\.com" → ".*\\.asdf\\.com").
• Added a new regression test asserting WebProxy.IsBypassed actually returns true for a host matching a wildcard NO_PROXY entry, and false for a non-matching host.

Test Status

Ran targeted tests: dotnet test tests/Paket.Tests/Paket.Tests.fsproj --filter "FullyQualifiedName~env proxy|FullyQualifiedName~no_proxy".

• New test no_proxy wildcard bypass entry actually bypasses matching subdomain passes.
• Updated test get http env proxy with bypass list containing wildcards passes with corrected expectation.
• 4 pre-existing failures in this same filter (get http/https env proxy with port and credentials, no env proxy without http/https_proxy env var) were confirmed via git stash to already fail identically on master before this change — they are caused by test-parallelism/env-var pollution across proxy tests, unrelated to this fix. No new failures were introduced.

As always, please review before merging — happy to adjust if maintainers see edge cases I've missed (e.g. Mono/CUSTOM_WEBPROXY build path bypass matching, which is a separate code path not touched here).

Generated by 🌈 Repo Assist, see workflow run. Learn more.
_{Comment /repo-assist to run again}

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/repo-assist.md@ae8d551f07c7ed7619f8c58c7bb4c3ac89395d38