fix(ext/fetch): enforce permissions for proxy transports (#36217)
## Summary
Some proxy transports connect directly instead of going through the
regular HTTP connector. Check the actual SOCKS, Unix, and VSOCK proxy
endpoints before opening those connections.
Legacy `proxy.url` values now reject schemes that do not match the
supported HTTP and SOCKS URL forms, keeping initial validation aligned
with the transport that is ultimately selected. Explicit typed Unix
proxy configuration continues to work as before, and embedders that
construct clients without a permission container retain their existing
behavior.
## Validation
- Built the development Deno binary with `cargo build -p deno`
- Ran focused rebuilt-runtime tests for environment Unix proxies and
legacy custom-client URL handling
- Ran `cargo test -p unit_tests --test unit -- fetch_test`
- Ran `cargo test -p deno_fetch`
