nono-py policy handling may fail open for proxy restrictions

Policy-derived ProxyConfig did not enforce CapabilitySet.proxy_only, and policy JSON accepted unknown security-sensitive fields.

Users of nono-py who rely on policy-based network restrictions, especially those using domain allowlists with proxy configurations.

Update nono-py to the latest patched version and ensure policy-resolved proxy configurations are coupled with CapabilitySet.proxy_only(proxy).