Allow credential-scoped JFrog S3 npm redirects

[dzmitry-zhdanovich]

What are you trying to accomplish?

Allow npm artifact downloads from the configured Wolters Kluwer Artifactory registry. Its artifact request redirects to jfrog-platform.s3.eu-west-1.amazonaws.com, which was blocked by egress filtering. The redirect host is now derived only for jobs configured with the exact Artifactory registry hostname.

Resolves the reported egress block during npm package installation. No issue number was provided.

Anything you want to highlight for special attention from reviewers?

The S3 host is deliberately not added to a global allowlist. registry_redirect_derivations permits this exact destination only for jobs whose registry credential names artifactory.wolterskluwer.io. The reported 302 establishes the redirect relationship; the S3 endpoint's unsigned 403 response does not independently establish bucket ownership. Exact host matching avoids opening sibling hosts or other regions, and no signed query parameters are included.

How will you know you've accomplished your goal?

Regression tests verify that the configured registry's artifact destination is allowed, while the destination remains blocked without that registry credential and for lookalike/other-region hosts.

Validation:

• docker run --rm --entrypoint /bin/sh dependabot/proxy-builder-tests -c 'go build ./... && go test ./internal/handlers/ -run TestEgress -count=1' - passed.
• docker run --rm --entrypoint /bin/sh dependabot/proxy-builder-tests -c 'go test -race -shuffle=on -count=2 ./...' - passed.
• The script/test wrapper could not run directly because the checked-out shell script has CRLF line endings; its Docker test command was run directly. No separate linter was run.

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.