OPA policies should normalize input.http.host for well-known ports

Description

As requested by @tonistiigi I am opening this as a feature request here.

I am currently playing with the buildkit exec proxy and depending on the tools I am using (for instance curl), the requested URLs include the default HTTP(S) ports.

As an example the following Dockerfile and policy fails:

FROM ubuntu:26.04
RUN apt-get update -y && apt-get install -y curl
ARG CACHE_BUSTER
RUN curl -qf "https://example.com"

policy:

package docker

default allow := false

allowed_hosts := [
    "security.ubuntu.com",
    "archive.ubuntu.com",
    "example.com"
]

allow if input.local
allow if input.image

allow if {
  input.http.host in allowed_hosts
}

decision := {
	"allow": allow,
	"caps": {"exec.proxy": true},
}

build via a buildkit builder with network proxy enabled:

docker buildx build --builder=buildkitd "--build-arg=CACHE_BUSTER=$(date)" --progress=plain .

and observe the following failure:

#7 [3/3] RUN curl -qf "https://example.com"
#7 0.086   % Total    % Received % Xferd  Average Speed  Time    Time    Time   Current
#7 0.086                                  Dload  Upload  Total   Spent   Left   Speed
  0      0   0      0   0      0      0      0                              0
#7 0.103 curl: (22) The requested URL returned error: 403
#7 ERROR: process "/bin/sh -c curl -qf \"https://example.com\"" did not complete successfully: exit code: 22

#1 loading policies Dockerfile.rego
#1 0.196 checking policy for source local://context
#1 0.200 policy decision for source local://context: ALLOW
#1 0.209 checking policy for source docker-image://docker.io/library/ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b (linux/amd64)
#1 0.216 policy decision for source docker-image://docker.io/library/ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b (linux/amd64): ALLOW
#1 0.323 checking policy for source https://example.com:443/
#1 0.328 policy decision for source https://example.com:443/: DENY
#1 DONE 0.3s

If I change the policy to include example.com:443 as allowed_host then it works. I think it would be great if the default ports of 80 and 443 are stripped. If a non-default port is used it could stay included or the port could move into a different variable completely?

Start by tracing where the build proxy constructs the OPA policy input for input.http.host, using the Dockerfile, policy, and curl example in the issue to reproduce the default-port behavior. Done means policies accepting example.com also accept HTTPS requests reported as example.com:443, while non-default ports retain their distinction.