nuget.devexpress.com: allow nuget-cdn.devexpress.com download redirect for jobs with a DevExpress registry #317

Since proxy-egress-enforce was enabled (first seen with proxy v2.0.20260925183918), every nuget update that uses the licensed DevExpress NuGet feed fails with private_source_authentication_failure.

The feed is declared under registries: as a nuget-feed (https://nuget.devexpress.com/<feed-key>/api/v3/index.json), so the proxy allows nuget.devexpress.com and all metadata requests succeed. But the feed answers every .nupkg download with a 302 to a pre-signed CloudFront URL on nuget-cdn.devexpress.com, and the proxy blocks that second hop:

proxy | [468] 302 https://nuget.devexpress.com:443/<feed-key>/api/v3/package/devexpress.drawing/25.2.9/devexpress.drawing.25.2.9.nupkg
proxy | [025] GET https://nuget-cdn.devexpress.com:443/devexpress.xpo/25.2.9@<build>/devexpress.xpo.25.2.9.nupkg?Expires=...&Signature=...&Key-Pair-Id=...
proxy | [025] * egress not allowlisted nuget-cdn.devexpress.com
proxy | [025] 403 https://nuget-cdn.devexpress.com:443/devexpress.xpo/25.2.9@<build>/devexpress.xpo.25.2.9.nupkg?Expires=...
updater | ERROR Error type: private_source_authentication_failure

Proxy v2.0.20261012184137. The last successful run was on proxy v2.0.20260923170141 with only proxy-egress-observe; it logged the same egress not allowlisted nuget-cdn.devexpress.com lines, but the downloads still went through. Every licensed DevExpress package (DevExpress.Drawing, DevExpress.Xpo, DevExpress.Printing.Core, ...) is served through this CDN, so any repository on the DevExpress feed is affected. This is the same shape as #285 (packagecloud) and #306 (Telerik).

About the host

• An exact hostname owned by DevExpress. TLS certificate: O=Developer Express Inc., CN=*.devexpress.com (GoDaddy OV). It is a CNAME to a dedicated CloudFront distribution (d1473rlr96tcmv.cloudfront.net).
• It serves only DevExpress package artefacts, and only via signed URLs that nuget.devexpress.com issues after validating the customer's feed key. An unsigned request to a real artefact path returns 403 from CloudFront, and the feed without a key returns 401.

Request: add a registry_redirect_derivations entry so that nuget-cdn.devexpress.com is allowed only for jobs that have a nuget.devexpress.com credential:

  # The DevExpress NuGet feed redirects package downloads to pre-signed URLs on
  # its own CloudFront distribution.
  - credential_host: nuget.devexpress.com
    derived:
      - nuget-cdn.devexpress.com

If there's a supported way to allow this from dependabot.yml instead (for example a per-registry list of redirect hosts, as suggested in #306), we're happy to use it.