feat(security): security hardening, proxy support, and GL045 HTTP include warning

Security fixes:
- Path traversal guard in include: local: — paths with ../ that escape
  the repo root are rejected instead of reading arbitrary host files
- HTTP timeout (30 s) on all fetcher requests to prevent indefinite hangs
- Response size cap (10 MiB) via io.LimitReader to prevent memory exhaustion
- Cache directory and file permissions tightened to 0700/0600
- LSP Content-Length cap (64 MiB) to guard against DoS from a malicious client

New feature:
- --proxy flag on check, graph, and lsp subcommands; also proxy: key in
  .glint.yml; overrides system HTTP_PROXY / HTTPS_PROXY env vars when set;
  cmdGraph and cmdLSP now also load .glint.yml for proxy/token/url fallbacks

New lint rule:
- GL045 (Warning): include: remote: using plain http:// instead of https://

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/linter/includes.go

@@ -0,0 +1,31 @@
+package linter
+
+import (
+	"fmt"
+	"strings"
+
+	"git.k3nny.fr/glint/internal/model"
+)
+
+// checkInsecureRemoteInclude warns when an include: remote: entry uses plain
+// HTTP (GL045). The file is still fetched and linted; the finding is a warning
+// so pipelines that use HTTP for internal infra are not blocked.
+func checkInsecureRemoteInclude(p *model.Pipeline) []Finding {
+	var findings []Finding
+	for _, inc := range p.Include {
+		m, ok := inc.(map[string]any)
+		if !ok {
+			continue
+		}
+		remote, _ := m["remote"].(string)
+		if strings.HasPrefix(remote, "http://") {
+			findings = append(findings, Finding{
+				Severity: Warning,
+				Rule:     RuleInsecureRemoteInclude,
+				File:     p.SourceFile,
+				Message:  fmt.Sprintf("remote include %q uses plain HTTP; CI templates are fetched unencrypted — prefer HTTPS", remote),
+			})
+		}
+	}
+	return findings
+}