## Summary
Disable automatic system-proxy discovery for workflow webhook requests.
## Why
Webhook destinations are resolved, validated, and pinned before the
request to prevent DNS-rebinding SSRF. If reqwest uses a system proxy,
the proxy can resolve the original hostname itself instead of connecting
to the validated address, bypassing that pinning guarantee.
Calling `no_proxy()` keeps these security-sensitive requests on the
directly validated connection path. Redirects remain disabled.
## Test plan
- `cargo fmt --all -- --check`
- `cargo test -p buzz-workflow --features reqwest` (149 passed)
- `cargo clippy -p buzz-workflow --all-targets --features reqwest -- -D
warnings`
- `git diff --check`
Co-authored-by: Amp <amp@ampcode.com>
