feat(network): return JSON policy denials by default - #1825

Return structured network and secret policy errors with a stable code,
message, and destination domain for supported HTTP requests. Guard secret
responses against pipelining and upstream response bytes.

Expose format and per-policy messages across SDKs and CLI configuration,
retain explicit opt-out and legacy text mode, and validate runtime support.
Update documentation and protocol tests. Preserve typed Go config errors
across normal and progress creation.

Keep archive admission fixtures focused on layout and replacement checks by explicitly disabling HTTP denials unsupported by their historical runtimes.

Use cached DNS evidence for no-SNI policy decisions while retaining the destination IP for certificate and secret identity. Preserve legacy TLS bypass, reject malformed SNI during interception, and keep the first hostname for policy peeking.

Compare IP authorities by address and cover fragmented handshakes, policy enforcement, certificate verification, and secret denial with parser regressions and real-sandbox IPv4 and IPv6 tests.

Merge current main and update the new TLS regression tests for its upstream-stream constructor. Document the expected MemoryBIO handshake exceptions in the guest fixtures.

Replace the changed Go and TypeScript HTTP table entries with property sections and visible signatures, preserving their defaults and denial-response links.