policy: enable proxy network from source policy caps

Evaluate source policy caps before solve requests so policies can enable
BuildKit proxy networking. Policy can return caps {"exec.proxy": true}
during the caps request to enable proxy network
support for the solve.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>

policy/types.go

@@ -21,14 +21,24 @@ type Input struct {
 type Decision struct {
 	Allow        *bool    `json:"allow,omitempty"`
 	DenyMessages []string `json:"deny_msg,omitempty"`
+	Caps         Caps     `json:"caps,omitempty"`
+}
+
+type Caps map[string]bool
+
+const CapExecProxy = "exec.proxy"
+
+var KnownCaps = map[string]struct{}{
+	CapExecProxy: {},
 }
 
 type Env struct {
-	Args     map[string]*string `json:"args,omitempty"`
-	Labels   map[string]string  `json:"labels,omitempty"`
-	Filename string             `json:"filename,omitempty"`
-	Target   string             `json:"target,omitempty"`
-	Depth    int                `json:"depth"`
+	Args        map[string]*string `json:"args,omitempty"`
+	Labels      map[string]string  `json:"labels,omitempty"`
+	Filename    string             `json:"filename,omitempty"`
+	Target      string             `json:"target,omitempty"`
+	CapsRequest bool               `json:"capsRequest,omitempty"`
+	Depth       int                `json:"depth"`
 }
 
 type HTTP struct {