[flthibaud]

Guard.Transport cloned http.DefaultTransport, which keeps ProxyFromEnvironment. With HTTP_PROXY/HTTPS_PROXY set, the dialer connected to the proxy, so the SSRF guard vetted the proxy's address instead of the target's.

• t.Proxy = nil: every guarded fetch is a direct dial the guard sees.
• New test TestTransportDialsTargetNotProxy.
• README: outbound proxies are not supported.

Tested with gofmt, go vet ./... and go test -race ./... against a migrated postgres:16 (no test skipped).

Closes #46

[flthibaud]

Review: OK to merge.

• Code, test and README by Mistral, unchanged.
• This is a behaviour change for anyone who relied on HTTPS_PROXY for feed fetches: those now go direct. Nothing is deployed, so nobody is affected today.
• Not covered: the browser-impersonating client (tls-client) builds its own transport. I did not check whether it reads proxy variables.