run_command(ignore_env=True) starts openstack-image-manager with an empty environment

[berendt]

Follow-up to osism/issues#1432 (Support proxy for manager service).

What happens

The OpenStack manager tools are started through run_command() with an empty
environment dict and ignore_env=True, see osism/tasks/openstack.py
(image_manager, flavor_manager, run_openstack_command_with_cloud, …):

return run_command(
    request_id,
    command,
    {},
    *arguments,
    ...
    ignore_env=True,
)

and osism/tasks/__init__.py:

if ignore_env:
    command_env = env
else:
    command_env = os.environ.copy()
    command_env.update(env)

ignore_env=True together with env={} means the subprocess is started with a
completely empty environment. Nothing that is configured for the openstack
worker container reaches the tool.

Why this matters

• HTTP_PROXY / HTTPS_PROXY / NO_PROXY never arrive. On deployments where
  the manager has no direct outbound connectivity, openstack-image-manager
  cannot reach the image sources at all. This is the blocker reported in
  Support proxy for manager service issues#1432. The manager role of osism.services can now set the
  proxy for all services of the manager, but the value stops at this boundary.
• The same applies to the aria2c subprocess that openstack-image-manager
  uses to prefetch images (openstack_image_manager/main.py, _download()).
  It inherits the empty environment, and aria2 only reads the lowercase
  http_proxy / https_proxy / no_proxy names.
• REQUESTS_CA_BUNDLE, CURL_CA_BUNDLE and SSL_CERT_FILE are lost as well,
  which matters for a proxy that terminates TLS, and so are PATH, HOME,
  LANG and TZ (without PATH, shutil.which("aria2c") falls back to
  os.defpath).

Suggested fix

The blanking was introduced in #1687, which carries no description. The
apparent purpose is to keep the OS_* variables from openstack.env out of
the tools so that they do not override the --cloud selection from
clouds.yaml. Dropping the entire environment is a wider hammer than needed.

Pass through an explicit allowlist instead of starting from {}:

• PATH, HOME, LANG, LC_*, TZ
• SSL_CERT_FILE, SSL_CERT_DIR, REQUESTS_CA_BUNDLE, CURL_CA_BUNDLE
• HTTP_PROXY, HTTPS_PROXY, NO_PROXY, ALL_PROXY and their lowercase
  spellings

An alternative is to keep os.environ and remove the OS_* variables. That
fixes the reported symptom too, but lets everything else back in, so the
allowlist is the safer of the two.

Acceptance criteria

• openstack-image-manager and the other tools invoked with ignore_env=True
  run with the proxy and CA variables of their container.
• OS_* variables from openstack.env still do not reach these tools.
• A unit test covers both directions.