[wuraxor]

Add configurable SOCKS5 proxies to WebSocket and HTTP clients, including WS/WSS and HTTP/HTTPS. Proxy settings are opt-in through ProxyOptions and setProxyOptions(); existing callers retain their current connection behavior.

The TCP connection and SOCKS5 negotiation share one internal connector used by plain sockets, OpenSSL/LibreSSL, Mbed TLS, and SecureTransport. The existing socket hierarchy and TLS implementations remain in place, and TLS uses the original destination hostname for SNI and certificate verification. This replaces the original proposal's copied TLS implementations and incorporates current master, including recent close/cancellation fixes.

• Local or proxy-side destination DNS; numeric IPv4/IPv6 destinations use their corresponding SOCKS address types.
• Optional username/password authentication, with explicit protocol validation and bounded reads that handle fragmented replies without consuming tunneled data.
• Existing connection deadlines and cancellation apply during proxy negotiation. Failed tunnels never fall back to a direct connection. WebSocket reconnections retain the configured proxy.
• C++11 implementation, public installed header, usage documentation, and installed-consumer coverage for the new setters.

Network.framework TLS currently rejects proxy configuration with an explicit error. During validation, its native SOCKS API bypassed the proxy for loopback destinations even with direct fallback disabled, and stalled on fragmented replies. Native SOCKS integration is therefore excluded pending a separate implementation. Plain connections in a Network.framework build use the shared connector normally. SOCKS4 and HTTP CONNECT are outside this change.

Validation:

• Full suites: OpenSSL 27/27, Mbed TLS 28/28, Network.framework 27/27, Linux GCC 24/24.
• Final SOCKS5 tests: 201 assertions each with OpenSSL and Mbed TLS; 170 assertions under ThreadSanitizer.
• Tests exercise fragmented/truncated/malformed replies, authentication, DNS and address variants, protocol length limits, HTTP/HTTPS and WS/WSS, reconnections, destination certificate verification, cancellation/deadlines, and rejection without direct fallback.
• Windows MinGW builds the library, CLI, and tests; SecureTransport builds successfully.
• Installed C++11 consumer builds and runs with the new API; changed C++ code formatted with the repository's clang-format configuration.

[bsergean]

That's a big PR so it will take a bit of time to review, hope you understand.

[bsergean]

@wuraxor I'm having an agent trying to implement this, following libcurl design.