fix: cherry-pick API proxy review fixes to sidecar branch

[Mossaka]

Tracking issue from closed PR #752.

Changes needed

• API proxy firewall exemption: Add proxyIp parameter to setupHostIptables() to allow unrestricted egress for the sidecar at 172.30.0.30
• Envoy healthcheck: Change from custom health endpoint to Envoy admin endpoint (http://localhost:9901/ready)
• Security hardening: Simplify cap_drop from selective capability list to ['ALL'] for maximum security
• Test coverage: Add unit tests covering API proxy service generation, environment injection, security hardening, and conditional behavior
• Documentation: Update comments and docs for host header rewriting and conditional BASE_URL environment variables

Original PR: #752