[Integ] Add integration test for Pcluster Build Image in proxied environment

[himani2411]

Description of changes

Adds integration test which creates a proxied environment for testing ParallelCluster Build Image.
Updated proxy.yaml by introducing EnableBuildImageProxy to distinguish build-time from cluster-time proxy configurations. Key changes include:

• Expands proxy allowlist for AWS services (CloudFront, S3), FSx repos, EFA installer, EFS-utils dependencies (Rust and Index) and OS repos.
• Adds snap store allowlist to resolve dpkg lock issues during DCV installation
• Grants AmazonS3ReadOnlyAccess for Node package presigned URL generation in cookbook recipe and use install_proxy_url Devsetting added as part of cookbook PR [DevSetting] Add install_proxy_url which will allow ParallelCluster to set Proxy environment for Build Image installation aws-parallelcluster-cookbook#3157
• We skip awsbatch CLI installation for this test as we will be deprecating this dependency.
• Enables IP forwarding to prevent kernel packet drops in ConfigureSystem step
• Switches from GitHub to S3 URLs for aws-parallelcluster-cookbook downloads to avoid SSL connection failures through proxy

Tests

• Successful Build image with ALINUX 2023, Rhel9/8, Rocky9/8 and Ubuntu22/24
• Integ test

   proxy:
    test_proxy.py::test_proxy:
      dimensions:
        - regions: ["us-east-1"] # c5 instance type is not available in ap-southeast-5
          instances: ["c5.xlarge"]
          oss: [{{ OS_X86_7 }}]
          schedulers: ["slurm"]

References

• Link to impacted open issues.
• Link to related PRs in other packages (i.e. cookbook, node).
• Link to documentation useful to understand the changes.

Checklist

• Make sure you are pointing to the right branch.
• If you're creating a patch for a branch other than develop add the branch name as prefix in the PR title (e.g. [release-3.6]).
• Check all commits' messages are clear, describing what and why vs how.
• Make sure to have added unit tests or integration tests to cover the new/modified code.
• Check if documentation is impacted by this change.

Please review the guidelines for contributing and Pull Request Instructions.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[gmarciani]

Not introduced by this PR, so we can address in a different PR, but this is allowing global access to SSH port and could cause alarms. What about restricting the access to the VPC CIDR instead?

[himani2411]

One of the checks we do as part of the test_proxy test to to be able to login into the HeadNode using a Bastion instance from another VPC, which is why I will keep the current SSHCidr. Since we have had no issues so far and this is an ephemeral stack we can decrease the priority for this specific change.

[gmarciani]

We agreed on addressing the compatibility with other partitions in a separate PR.