Fix egress/AppArmor configs found during host install

- AppArmor network rules must use socket types (stream/dgram),
  not protocol names (tcp/udp/icmp): the parser rejected the
  profile (Invalid network entry) until fixed.
- Tinyproxy has no 'Upstream none' syntax; the line failed the
  service at startup. Direct connection is the default, so the
  line is removed.
- Tinyproxy Filter is POSIX BASIC regex, not extended: the
  extended-style anchored patterns denied even allowed domains
  (verified: xcmapi.org got 403). Rewritten in basic syntax
  (\(...\)* groups); the anchored form still blocks
  evilgithub.com and xcmapi.org.evil.com (verified on host).
- Filter file must be world-readable (was 640 root:root, so
  tinyproxy could not read it and exited on reload); install
  steps now chmod 644 (documented in the filter header via
  the install note in tinyproxy.conf).
Host already runs these exact files (proxy allow/block
verified: xcmapi/github/api.github 200, example/evilgithub/
xcmapi.org.evil.com 403).

deploy/egress/tinyproxy.conf

@@ -45,8 +45,8 @@ ConnectPort 80
 # Allowlist: deny everything not in the filter file.
 FilterDefaultDeny Yes
 Filter "/etc/tinyproxy/tinyproxy-filter"
-# Upstream: direct (no parent proxy). The host's own egress is
-# unrestricted; only container traffic goes through this proxy.
-Upstream none
+# No Upstream directive: direct connection is Tinyproxy's default.
+# (There is no valid "Upstream none" syntax; an invalid line here
+# used to fail the whole service at startup.)
 # Do not forward proxy headers that leak container info.
 DisableViaHeader Yes