fix(turnstile): route CAPTCHA verification through the configured proxy (#38412)

Fixes #38217

## Problem

Turnstile CAPTCHA verification uses `http.DefaultClient`, so the request
to `challenges.cloudflare.com` bypasses Gitea's configured HTTP proxy —
unlike other outbound HTTP clients such as the update checker
(`modules/updatechecker/update_checker.go`) and migrations. In
deployments where egress is only permitted through the configured proxy,
verification fails.

## Fix

Build the client with `proxy.Proxy()` as the transport proxy, mirroring
the update checker:

```go
func httpClient() *http.Client {
	return &http.Client{
		Transport: &http.Transport{
			Proxy: proxy.Proxy(),
		},
	}
}
```

The client is built per call (rather than a package-level var) because
`proxy.Proxy()` reads `setting.Proxy` when invoked; building it at
request time ensures it reflects the loaded settings. When no proxy is
configured, behavior is unchanged (`proxy.Proxy()` returns a no-op /
`http.ProxyFromEnvironment`).

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

modules/turnstile/turnstile.go

@@ -12,9 +12,20 @@ import (
 	"strings"
 
 	"gitea.dev/modules/json"
+	"gitea.dev/modules/proxy"
 	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
+// httpClient returns an HTTP client that honors Gitea's proxy configuration.
+var httpClient = util.OnceValue[*http.Client]{
+	Func: func() *http.Client {
+		transport := http.DefaultTransport.(*http.Transport).Clone()
+		transport.Proxy = proxy.Proxy()
+		return &http.Client{Transport: transport}
+	},
+}
+
 // Response is the structure of JSON returned from API
 type Response struct {
 	Success     bool        `json:"success"`
@@ -40,7 +51,7 @@ func Verify(ctx context.Context, response string) (bool, error) {
 	}
 	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 
-	resp, err := http.DefaultClient.Do(req)
+	resp, err := httpClient.Value().Do(req)
 	if err != nil {
 		return false, fmt.Errorf("Failed to send CAPTCHA response: %w", err)
 	}