Align deltaproxy proxy setup with the single proxy (#70223)

[ggiesen]

What does this PR do?

Brings two pieces of deltaproxy's proxy setup back in line with the single-proxy metaproxy.

What issues does this PR fix?

Fixes #70223

Root cause

proxy_merge_pillar_in_opts was ignored. salt/metaproxy/proxy.py guards the pillar-into-opts merge behind that option and treats proxy_mines_pillar as the elif. deltaproxy.py had no guard, so the documented option (default False) had no effect and the control proxy's pillar always won over its opts. Sub-proxy opts begin as a copy of the control proxy's opts, so anything the pillar injected was inherited by every sub-proxy.

A proxymodule's module_executors was dropped for sub-proxies. post_master_init reads it for the control proxy, but subproxy_post_master_init never set it, so thread_return's getattr(minion_instance, "module_executors", []) found nothing and fell back to the opts default. The single-proxy metaproxy honours the declaration.

Previous Behavior

With proxy_merge_pillar_in_opts unset, a plain key in the control proxy's pillar became an opts key on the control proxy and on every sub-proxy. A proxymodule declaring module_executors had that declaration silently ignored on every sub-proxy.

New Behavior

The merge only happens when the option asks for it, and a sub-proxy picks up its own proxymodule's module_executors.

Merge requirements satisfied?

• Docs
• Changelog
• Tests written/updated

Tests written?

Yes. A unit test asserts subproxy_post_master_init sets module_executors from the sub-proxy's own proxymodule; it fails against unmodified 3008.x.

Both halves were verified against a live deltaproxy on 3008.2 with three sub-proxies.

Pillar merge, reading opts only (config.get <key> omit_pillar=True), with proxy_merge_pillar_in_opts unset:

	before	after
dpcontrol	LEAKED_FROM_PILLAR	empty
minion1	LEAKED_FROM_PILLAR	empty
minion2	LEAKED_FROM_PILLAR	empty

And with proxy_merge_pillar_in_opts: True the merge still happens as documented, so the feature is preserved rather than removed.

module_executors, from a proxymodule declaring ["direct_call"], as seen by thread_return:

before:  id=minion1 has_attr=False value='<MISSING>'
         id=minion2 has_attr=False value='<MISSING>'
         id=minion3 has_attr=False value='<MISSING>'

after:   id=minion1 has_attr=True value=['direct_call']
         id=minion2 has_attr=True value=['direct_call']
         id=minion3 has_attr=True value=['direct_call']

Commits signed with GPG?

No