fix(turnstile): route CAPTCHA verification through the configured proxy (#38412)

Fixes #38217

## Problem

Turnstile CAPTCHA verification uses `http.DefaultClient`, so the request
to `challenges.cloudflare.com` bypasses Gitea's configured HTTP proxy —
unlike other outbound HTTP clients such as the update checker
(`modules/updatechecker/update_checker.go`) and migrations. In
deployments where egress is only permitted through the configured proxy,
verification fails.

## Fix

Build the client with `proxy.Proxy()` as the transport proxy, mirroring
the update checker:

```go
func httpClient() *http.Client {
	return &http.Client{
		Transport: &http.Transport{
			Proxy: proxy.Proxy(),
		},
	}
}
```

The client is built per call (rather than a package-level var) because
`proxy.Proxy()` reads `setting.Proxy` when invoked; building it at
request time ensures it reflects the loaded settings. When no proxy is
configured, behavior is unchanged (`proxy.Proxy()` returns a no-op /
`http.ProxyFromEnvironment`).

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

modules/util/sync_test.go

@@ -0,0 +1,49 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package util
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestOnceValue(t *testing.T) {
+	t.Run("RepeatCall", func(t *testing.T) {
+		callCount := 0
+		o := OnceValue[int]{Func: func() int {
+			callCount++
+			return 42
+		}}
+		assert.Equal(t, 42, o.Value())
+		assert.Equal(t, 42, o.Value())
+		assert.Equal(t, 1, callCount)
+		o.Reset()
+		assert.Equal(t, 42, o.Value())
+		assert.Equal(t, 2, callCount)
+		assert.Equal(t, 42, o.Value())
+		assert.Equal(t, 2, callCount)
+	})
+
+	t.Run("Panic", func(t *testing.T) {
+		callCount := 0
+		doPanic := true
+		o := OnceValue[int]{Func: func() int {
+			callCount++
+			if doPanic {
+				panic("some error")
+			}
+			return 42
+		}}
+		assert.PanicsWithValue(t, "some error", func() { o.Value() })
+		assert.PanicsWithValue(t, "some error", func() { o.Value() })
+		assert.Equal(t, 1, callCount)
+		doPanic = false
+		o.Reset()
+		assert.Equal(t, 42, o.Value())
+		assert.Equal(t, 2, callCount)
+		assert.Equal(t, 42, o.Value())
+		assert.Equal(t, 2, callCount)
+	})
+}