fix(llmobs): support HTTPS_PROXY setting [backport 3.18] (#15165)

Backport 7bc20af from #15130 to 3.18.

The built in `http.client` that we use does not support the
HTTP{S}_PROXY environment variable (or proxying in general). AI tells me
that the fix is pretty straightforward by extending the client.

## Testing

I manually validated this solution by installing
[squid](https://www.squid-cache.org/) locally with a small test app:

```
# demonstrate the proxy working locally with curl
(.venv) ~/d/dd-trace-py ❯❯❯ HTTPS_PROXY=http://127.0.0.1:3128 curl https://google.com
(.venv) ~/d/dd-trace-py ❯❯❯ tail -n 1 /opt/homebrew/var/logs/squid/access.log
1762370301.555    185 127.0.0.1 TCP_TUNNEL/200 7488 CONNECT google.com:443 - HIER_DIRECT/142.250.81.238 -

(.venv) ~/d/dd-trace-py ❯❯❯ HTTPS_PROXY=http://127.0.0.1:3128 ddtrace-run python openai-app.py
(.venv) ~/d/dd-trace-py ❯❯❯ tail -n 2 /opt/homebrew/var/logs/squid/access.log
1762370369.733    169 127.0.0.1 TCP_TUNNEL/200 4049 CONNECT llmobs-intake.datadoghq.com:443 - HIER_DIRECT/3.233.158.217 -
1762370369.845   3857 127.0.0.1 TCP_TUNNEL/200 6469 CONNECT api.openai.com:443 - HIER_DIRECT/162.159.140.245 -
```

and confirmed the trace is sent successfully:

<img width="878" height="75" alt="image"
src="https://github.com/user-attachments/assets/0f76b8c0-82a9-410b-af4e-77364a9d7b70"
/>


## Risks

<!-- Note any risks associated with this change, or "None" if no risks
-->

No impact to non-`HTTPS_PROXY` setting usage so risk is pretty limited. 

## Additional Notes

<!-- Any other information that would be helpful for reviewers -->

Co-authored-by: kyle <kyle@verhoog.ca>
Co-authored-by: Yun Kim <35776586+Yun-Kim@users.noreply.github.com>
Co-authored-by: Brett Langdon <brett.langdon@datadoghq.com>

Author: 4 people

ddtrace/llmobs/_http.py

@@ -0,0 +1,49 @@
+import os
+import ssl
+from typing import Optional
+from urllib.parse import urlparse
+
+from ddtrace.internal.http import HTTPConnection
+from ddtrace.internal.http import HTTPSConnection
+from ddtrace.internal.uds import UDSHTTPConnection
+from ddtrace.internal.utils.http import DEFAULT_TIMEOUT
+from ddtrace.internal.utils.http import ConnectionType
+from ddtrace.internal.utils.http import verify_url
+
+
+class ProxiedHTTPSConnection(HTTPSConnection):
+    """
+    The built-in http.client in Python doesn't respect HTTPS_PROXY (even tho other clients like requests and curl do).
+
+    This implementation simply extends the client with support for basic proxies.
+    """
+
+    def __init__(
+        self, host: str, port: Optional[int] = None, context: Optional[ssl.SSLContext] = None, **kwargs
+    ) -> None:
+        if "HTTPS_PROXY" in os.environ:
+            tunnel_port = port or 443
+            proxy = urlparse(os.environ["HTTPS_PROXY"])
+            proxy_host = proxy.hostname or ""
+            # Default to 3128 (Squid's default port, de facto standard for HTTP proxies)
+            proxy_port = proxy.port or 3128
+            super().__init__(proxy_host, proxy_port, **kwargs)
+            self.set_tunnel(host, tunnel_port)
+        else:
+            super().__init__(host, port, **kwargs)
+
+
+def get_connection(url: str, timeout: float = DEFAULT_TIMEOUT) -> ConnectionType:
+    """Return an HTTP connection to the given URL."""
+    parsed = verify_url(url)
+    hostname = parsed.hostname or ""
+    path = parsed.path or "/"
+
+    if parsed.scheme == "https":
+        return ProxiedHTTPSConnection.with_base_path(hostname, parsed.port, base_path=path, timeout=timeout)
+    elif parsed.scheme == "http":
+        return HTTPConnection.with_base_path(hostname, parsed.port, base_path=path, timeout=timeout)
+    elif parsed.scheme == "unix":
+        return UDSHTTPConnection(path, hostname, parsed.port, timeout=timeout)
+
+    raise ValueError("Unsupported protocol '%s'" % parsed.scheme)

ddtrace/llmobs/_writer.py

@@ -26,7 +26,6 @@
 from ddtrace.internal.logger import get_logger
 from ddtrace.internal.periodic import PeriodicService
 from ddtrace.internal.utils.http import Response
-from ddtrace.internal.utils.http import get_connection
 from ddtrace.internal.utils.retry import fibonacci_backoff_with_jitter
 from ddtrace.llmobs import _telemetry as telemetry
 from ddtrace.llmobs._constants import AGENTLESS_EVAL_BASE_URL
@@ -45,6 +44,7 @@
 from ddtrace.llmobs._experiment import JSONType
 from ddtrace.llmobs._experiment import Project
 from ddtrace.llmobs._experiment import UpdatableDatasetRecord
+from ddtrace.llmobs._http import get_connection
 from ddtrace.llmobs._utils import safe_json
 from ddtrace.llmobs.types import _Meta
 from ddtrace.llmobs.types import _SpanLink

releasenotes/notes/llmobs-https-proxy-9ffc06b9f87df81b.yaml

@@ -0,0 +1,4 @@
+---
+fixes:
+  - |
+    LLM Observability: add support for HTTPS_PROXY.