HTTPS proxy helper sends CONNECT request and credentials over plaintext TCP

Issue description

The HTTP CONNECT proxy implementation in plugins/common/proxy/connect.go registers handlers for both http:// and https:// proxy schemes (lines 102–103), but uses the identical code path for both.

When an https:// proxy is configured, the client dials raw TCP to the proxy and sends the CONNECT request—including any proxy authentication credentials—in plaintext, without first establishing a TLS connection to the proxy.

At lines 102–103, both schemes are registered to the same handler. In DialContext at line 29, the connection to the proxy is always plain TCP. Proxy authentication credentials are then sent in cleartext at lines 59–61. The CONNECT request is written directly to the raw TCP connection at line 63. There is no additional TLS handshake when c.url.scheme is https.

Logs from Telegraf

None

System info

Latest Telegraf version

Docker

No response

Steps to reproduce

1. None

...

Expected behavior

The behavior should be as described above: when an https:// proxy is configured, the client should establish a TLS connection to the proxy before sending the CONNECT request or any proxy authentication credentials.

Actual behavior

The client establishes a plain TCP connection to the proxy and sends the CONNECT request and proxy authentication credentials without TLS, even when the proxy URL uses the https:// scheme.

Additional info

No response

Start in plugins/common/proxy/connect.go, reading the scheme handlers at lines 102–103 and DialContext around lines 29 and 59–63. Trace how the proxy URL scheme selects connection setup, then verify that an https:// proxy completes TLS before credentials or the CONNECT request are sent; add or update focused coverage if the repository provides it.