Fix case-insensitive allowlist matching and enforce lazy mitmproxy startup

[jimpudar]

Summary

• Normalize HTTPS and SSH allowlist entries and hostnames to lowercase so hostname matching is case-insensitive in the mitmproxy addon.
• Add a runtime guard that rejects any mitmproxy startup or option change unless connection_strategy=lazy, preventing the TLS deny path from failing open.
• Add focused unit tests for allowlist normalization, matcher behavior, and the connection strategy guard.

Testing

• python3 -m unittest proxy.test_mitmproxy_addon proxy.test_agent_spy proxy.test_agent_spy_tui
• py_compile validation for the addon and its tests passed with the bytecode cache redirected to a writable temp directory.
• git diff --check passed.
• bun test was not fully runnable in this workspace because local dependencies are missing (yargs/yargs).

---

^{Need help on this PR? Tag @codesmith with what you need.}

• Let Codesmith autofix CI failures and bot reviews