[marcmy]

What are you trying to accomplish?

Allow Dependabot's proxy to access Proton AG's public sparse Cargo registry (rust-registry.proton.me) when outbound egress allowlist enforcement is enabled.

The existing Cargo defaults cover crates.io and other registries/mirrors, but not Proton's public registry, which publishes crates including pvpnclient and muon. This PR adds its exact hostname to ecosystem_default_domains.cargo.

Anything you want to highlight for special attention from reviewers?

The allowlist entry is an exact hostname, not a .proton.me suffix or wildcard. A regression test verifies that evil.rust-registry.proton.me remains blocked.

The registry's sparse index configuration specifies the download URL:

{"dl": "https://rust-registry.proton.me/downloads/{crate}@{version}.crate"}

Both the sparse index and crate archives use the same hostname. A curl.exe -IL request to https://rust-registry.proton.me/downloads/muon@5.0.1.crate returned HTTP 200 without a redirect, so the checked download did not require another allowlisted host.

How will you know you've accomplished your goal?

The added regression cases verify:

• https://rust-registry.proton.me/index/config.json is permitted as a public registry endpoint.
• https://evil.rust-registry.proton.me/payload is rejected, preserving exact-host matching.

Testing

• CI — passed.
• Smoke — passed.
• Verified the public registry's config.json download URL and a successful HTTP 200 response for a sample .crate download, with no redirect.

The regression tests exercise proxy allowlist behavior, not an end-to-end Cargo update. Separately, the triage labeler workflow failed to apply the allowlist label; this was unrelated to a code test.

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.