feat(dialtesting): extend Lightpanda browser checks

[NaR82n]

What changed

• add wait_for_url and make URL/title/text assertions poll until their step or script timeout
• pass Lightpanda custom CA file/directory arguments while preserving a separate detected system CA directory
• add Lightpanda HTTP proxy support with task > script > node-default precedence
• add explicit private-network blocking and exact CIDR blocking options
• document the new task options and action behavior

Why

DataKit browser dial testing needs reliable redirect polling, enterprise CA trust, proxy routing, and browser-level private-network enforcement when running the Lightpanda 0.3.6-g2 build. Keeping these capabilities in cliutils avoids downstream modifications to vendored source.

Impact

Existing zero-value Lightpanda runner behavior remains unchanged. The new Lightpanda flags are only added when the corresponding runtime options are set. Assertions now wait for eventual consistency until timeout instead of failing on the first observation.

Validation

• go test ./dialtesting/browserdial/... -count=1
• Linux container: go test ./dialtesting/... -count=1
• Linux container: go vet ./dialtesting/...
• golangci-lint run --fix ./dialtesting/browserdial/... (0 issues)
• python copyright.py --dry-run
• git diff --check

Full-repository lint on the Windows host is blocked by existing platform-specific system syscall type-check errors; the changed browserdial packages lint cleanly.