Inject SSL context into urllib3 ProxyManager, too (#13343)

When a proxy is involved, requests uses a urllib3 proxy manager instead of
the pool manager. We only inject our SSL context into the pool manager,
which means the truststore context is lost when a proxy is set.

We can modify proxy manager construction by overriding proxy_manager_for
on the requests adapters.

Author: ichard26

news/13343.bugfix.rst

@@ -0,0 +1 @@
+Ensure truststore feature remains active even when a proxy is also in use.

src/pip/_internal/network/session.py

@@ -51,6 +51,7 @@
     from ssl import SSLContext
 
     from pip._vendor.urllib3.poolmanager import PoolManager
+    from pip._vendor.urllib3.proxymanager import ProxyManager
 
 
 logger = logging.getLogger(__name__)
@@ -283,6 +284,13 @@ def init_poolmanager(
             **pool_kwargs,
         )
 
+    def proxy_manager_for(self, proxy: str, **proxy_kwargs: Any) -> "ProxyManager":
+        # Proxy manager replaces the pool manager, so inject our SSL
+        # context here too. https://github.com/pypa/pip/issues/13288
+        if self._ssl_context is not None:
+            proxy_kwargs.setdefault("ssl_context", self._ssl_context)
+        return super().proxy_manager_for(proxy, **proxy_kwargs)  # type: ignore[misc]
+
 
 class HTTPAdapter(_SSLContextAdapterMixin, _BaseHTTPAdapter):
     pass