feat: route internet registry verification through proxy

[y-eight]

Problem

The webhook could not verify images hosted on internet registries that are only reachable through a forward proxy. While the verification path (go-containerregistry's DefaultTransport) already honors HTTP_PROXY/HTTPS_PROXY/NO_PROXY via http.ProxyFromEnvironment, those env vars were only injected into the init containers (which verify the webhook's own images at startup) — not the main webhook container that verifies pod images at admission time.

Changes

• chart/templates/deployment.yaml: inject HTTP_PROXY/HTTPS_PROXY/NO_PROXY into the main webhook container (gated by proxy.enabled), matching the init containers.
• webhook/cosignwebhook.go: make proxy support explicit and self-documenting via proxyTransport() (clones remote.DefaultTransport with http.ProxyFromEnvironment), wired into buildRemoteOpts through remote.WithTransport.
• chart/values.yaml + README.md: document the .telekom.de use case.

Usage

Set NO_PROXY to reach internal registries directly so only non-*.telekom.de images go through the proxy:

proxy:
  enabled: true
  httpsProxy: "http://proxy.telekom.de:8080"
  noProxy: ".telekom.de"

Verification

• go build ./... ✅
• go vet ./webhook/ ✅
• go test ./webhook/ ✅
• helm template renders proxy env on the webhook container and both init containers ✅

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}