Move the route proxy into its module and run it from the trust image, on mesh-sdk's public membership (issues 1633, 1634, 1635)

A bundle is built only from its module's directory (ADR 0480 clause 4), so the proxy leaves
examples/ and the controller's internal/broker; the broker keeps no second copy of what the
proxy shares with mesh-sdk. The image and its Dockerfile go, and a test holds that only
build-agent declares one (clause 11).

modules/route-proxy/vendor/github.com/klauspost/compress/internal/regmask/regmask.go

@@ -0,0 +1,50 @@
+//go:build !386
+
+// Package regmask provides masks for variable shift counts.
+//
+// Go defines a shift by more than the width of the shifted value as producing
+// zero, so the compiler has to guard every variable shift against that: on
+// amd64 with a CMP and an SBB, on arm64 with a CMP and a CSEL, and so on. When
+// the count is known to be smaller than the width anyway, masking it with the
+// width minus one lets the compiler drop the guard. The mask itself costs
+// nothing on the architectures whose shift instructions already use only the
+// low bits of the count, which the compiler knows about.
+//
+// Each constant is named for the width of the value being shifted and the type
+// of the shift count, and may only be used where the count is always smaller
+// than that width:
+//
+//	x := y >> (n & regmask.Shift64ByUint) // y is 64 bits, n is a uint below 64
+package regmask
+
+const (
+	// ShiftNByUint8 - shifting an N bit value by a uint8
+	Shift8ByUint8  = 7
+	Shift16ByUint8 = 15
+	Shift32ByUint8 = 31
+	Shift64ByUint8 = 63
+
+	// ShiftNByUint16 - shifting an N bit value by a uint16
+	Shift8ByUint16  = Shift8ByUint8
+	Shift16ByUint16 = Shift16ByUint8
+	Shift32ByUint16 = Shift32ByUint8
+	Shift64ByUint16 = Shift64ByUint8
+
+	// ShiftNByUint32 - shifting an N bit value by a uint32
+	Shift8ByUint32  = Shift8ByUint8
+	Shift16ByUint32 = Shift16ByUint8
+	Shift32ByUint32 = Shift32ByUint8
+	Shift64ByUint32 = Shift64ByUint8
+
+	// ShiftNByUint64 - shifting an N bit value by a uint64
+	Shift8ByUint64  = Shift8ByUint8
+	Shift16ByUint64 = Shift16ByUint8
+	Shift32ByUint64 = Shift32ByUint8
+	Shift64ByUint64 = Shift64ByUint8
+
+	// ShiftNByUint - shifting an N bit value by a uint
+	Shift8ByUint  = Shift8ByUint8
+	Shift16ByUint = Shift16ByUint8
+	Shift32ByUint = Shift32ByUint8
+	Shift64ByUint = Shift64ByUint8
+)

modules/route-proxy/vendor/github.com/klauspost/compress/internal/regmask/regmask_386.go

@@ -0,0 +1,39 @@
+//go:build 386
+
+package regmask
+
+// A 64 bit shift on 386 is synthesized from 32 bit instructions, and masking its
+// count makes the compiler emit more code rather than less, so those masks are
+// no-ops here: each is the largest value its count type can hold, which the
+// compiler folds away. Shifts of narrower values behave as elsewhere.
+const (
+	// ShiftNByUint8 - shifting an N bit value by a uint8
+	Shift8ByUint8  = 7
+	Shift16ByUint8 = 15
+	Shift32ByUint8 = 31
+	Shift64ByUint8 = 0xff
+
+	// ShiftNByUint16 - shifting an N bit value by a uint16
+	Shift8ByUint16  = Shift8ByUint8
+	Shift16ByUint16 = Shift16ByUint8
+	Shift32ByUint16 = Shift32ByUint8
+	Shift64ByUint16 = 0xffff
+
+	// ShiftNByUint32 - shifting an N bit value by a uint32
+	Shift8ByUint32  = Shift8ByUint8
+	Shift16ByUint32 = Shift16ByUint8
+	Shift32ByUint32 = Shift32ByUint8
+	Shift64ByUint32 = 0xffffffff
+
+	// ShiftNByUint64 - shifting an N bit value by a uint64
+	Shift8ByUint64  = Shift8ByUint8
+	Shift16ByUint64 = Shift16ByUint8
+	Shift32ByUint64 = Shift32ByUint8
+	Shift64ByUint64 = 0xffffffffffffffff
+
+	// ShiftNByUint - shifting an N bit value by a uint
+	Shift8ByUint  = Shift8ByUint8
+	Shift16ByUint = Shift16ByUint8
+	Shift32ByUint = Shift32ByUint8
+	Shift64ByUint = ^uint(0)
+)