[tintinhamans]

Merge after #645.

HTTP and websocket now share one proxy policy, set in settings.json as network.proxy: mode (automatic follows the Windows settings with static proxy, PAC and WPAD, disabled connects directly, custom uses address) and windows_login (default true). Routes are tried in order when a connection fails. Direct connections use HTTP/3 where available, otherwise HTTP/2, and the websocket uses HTTP/1.1. The scheme of PAC and WPAD results is read with the WinHTTP values, and without a WPAD or PAC file the lookup falls back to the static proxy or direct. Proxies get Basic, Digest or Negotiate (Kerberos with the current Windows account), no NTLM. As in Firefox, every proxy except SOCKS gets the Windows login when windows_login is on, including one found through PAC or WPAD.

When the proxy answers 407 a login dialog opens above the update check box. It is Menus/ProxyLogin.wnd in the style of the game's message boxes: caps title, a disabled Proxy row, a "Use Windows login" checkbox, username and password, Remember My Password, one fixed message area and caps buttons, with 15 units of padding. It is 260 units wide, and status and error messages are centred across the full width. It uses the game's own strings where they exist (OK, CANCEL, Password, Remember My Password, Connecting, Connection has failed, the wrong password message), so those are translated. The Windows login is tried silently first, and when it is rejected the dialog says "The Windows login was not accepted." For a SOCKS proxy the checkbox is unticked and greyed, since SOCKS cannot use it. The dialog also shows the connection test that the options menu of #655 runs on Accept. Proxy and GO login credentials share the DPAPI protected credentials.json, one entry per server or proxy.

network.server can now be custom with an address (host[:port], https only), with its own login and no fallback. Invalid network values in settings.json are reset to defaults on load and written back. The options menu for all of this is #655.

Build: vcpkg.json adds the curl features http2, http3 and sspi, with an overlay triplet in cmake/triplets. Deployment: Menus/ProxyLogin.wnd ships in the core pack, without it the dialog does not open and a proxy that asks for a login fails.

Tested: z_generals builds. Through local Basic and Digest proxies, set as custom and (Basic) through a Windows PAC script, the update check gets 407, the login dialog opens, the right password connects and a wrong one brings the dialog back with an error. The Windows login checkbox was rig tested against a Basic proxy: it is rejected and the dialog shows "The Windows login was not accepted." The dialog layout was checked through the UI rig with the right and wrong password and the Windows login. Not tested: WPAD, Negotiate against a real Kerberos proxy, the greyed checkbox for a SOCKS proxy.