Merge remote-tracking branch 'origin/master' into dev

Brings the go2rtc security fixes from #24658 to dev. Dev-specific changes
in the merge:
- frigate/config/env.py stays deleted; the environment_vars protection for
  GO2RTC_ALLOW_ARBITRARY_EXEC moves to apply_config_env_vars in
  frigate/util/env.py, so the value never reaches os.environ
- services.py imports substitute_frigate_vars from frigate.util.env and
  maps UnknownVariableError to the unknown variable message
- go2rtc stream tests patch dev's import-time exec override snapshot and
  its FRIGATE_* variable sources
- test_http_media.py keeps dev's _insert_recording helper; the one added
  on master replaced it and broke the dev tests

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docker/main/rootfs/usr/local/nginx/conf/auth_location.conf

@@ -14,7 +14,10 @@ location /auth {
     proxy_pass_request_headers off;
     # Pass info about the request
     proxy_set_header X-Original-Method $request_method;
-    proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+    proxy_set_header X-Original-URL $request_uri;
+    # set by the go2rtc stream locations; client headers are not forwarded, so
+    # this cannot be spoofed
+    proxy_set_header X-Go2rtc-Stream-Proxy $go2rtc_stream_proxy;
     proxy_set_header X-Server-Port $server_port;
     proxy_set_header Content-Length "";
     # Pass along auth related info

docker/main/rootfs/usr/local/nginx/conf/nginx.conf

@@ -219,6 +219,8 @@ http {
 
         # frigate lovelace card uses this path
         location /live/mse/api/ws {
+            # tells /auth to apply the go2rtc stream checks
+            set $go2rtc_stream_proxy 1;
             include auth_request.conf;
             limit_except GET {
                 deny  all;
@@ -228,6 +230,8 @@ http {
         }
 
         location /live/webrtc/api/ws {
+            # tells /auth to apply the go2rtc stream checks
+            set $go2rtc_stream_proxy 1;
             include auth_request.conf;
             limit_except GET {
                 deny  all;
@@ -248,6 +252,8 @@ http {
 
         # integration uses this to add webrtc candidate
         location /api/go2rtc/webrtc {
+            # tells /auth to apply the go2rtc stream checks
+            set $go2rtc_stream_proxy 1;
             include auth_request.conf;
             limit_except POST {
                 deny  all;

docker/main/rootfs/usr/local/nginx/conf/proxy.conf

@@ -2,7 +2,7 @@
 proxy_set_header Host $host;
 proxy_set_header Upgrade $http_upgrade;
 proxy_set_header Connection "Upgrade";
-proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+proxy_set_header X-Original-URL $request_uri;
 proxy_set_header X-Forwarded-Proto $scheme;
 proxy_set_header X-Forwarded-Host $http_host;
 proxy_set_header X-Forwarded-URI $request_uri;