Configure `buildkitd` network proxy settings

Currently it is possible to configure the gRPC client or frontend (when generating LLB) to instruct buildkitd to use proxy settings for each exec operation.

However, since the architecture allows running the frontend and backend (buildkitd) separately via the gRPC gateway, this means that buildkitd may be on an entirely different network. It stands to reason that 1) the client may not be aware of the backend's network egress requirements or 2) the client may be connecting to different backends with different network egress requirements. In these cases, configuring the client with the backend's required proxy settings is cumbersome (need to uncover or need to regularly switch).

It seems to me, then, that workers (OCI or containerd) should be configurable to automatically apply ProxyEnv to any ExecOps received.

Additionally, the next logical step would be to allow automatically applying network agents and/or config (SOCKS proxy, SSH ProxyCommand config, gitconfig for HTTP proxy, etc.). The first way to solve this that comes to mind is allowing OCI hooks to be configured for workers (which Earthly seems to do in their fork of buildkit).

Is there interest in further detailing/developing these features - worker config for proxy settings and OCI hooks - given the use case of buildkit running on a separate network with egress proxy requirements?

The issue names buildkitd workers, OCI and containerd workers, ProxyEnv, ExecOps, gRPC gateway operation, and OCI hooks, but no files, tests, or entry points. Start by locating worker configuration and ExecOp handling, then determine the scope and acceptance criteria for applying proxy settings or configuring hooks automatically.