kong-egress-proxy

An OSS alternative to the Enterprise forward-proxy plugin for the common
"all egress must cross a DMZ proxy" topology: sends the upstream hop itself
via Kong's bundled lua-resty-http with an absolute-form request line
(RFC 7230), origin Host, and Proxy-Authorization basic credentials.

HTTP upstreams only: https needs a CONNECT tunnel, which the plugin
deliberately does not attempt — https services are rejected (default) or
bypassed (on_https=bypass). Named egress-proxy to avoid clashing with the
Enterprise plugin name.