e2e: demux testcontainers exec stream, fix mtls proxy flags, add rtcp filter test

- Add ExecOutput helper to demultiplex the raw Docker exec stream so test
  output assertions see clean stdout+stderr instead of framed bytes.
- Wait for container readiness via exposed port or "listening on" log line
  when no ports are exposed.
- Use curl --proxy-* TLS options for the mTLS HTTPS-proxy test.
- Relax the http_cache first-request assertion (shared backend counter).
- Add gost#898 rtcp forwarder filter.host e2e test (multi-service one tunnel).
- Bump x to v0.15.7.

Co-Authored-By: Claude <noreply@anthropic.com>

tests/e2e/utils.go

@@ -10,6 +10,7 @@ import (
 
 	"github.com/moby/moby/client"
 	"github.com/testcontainers/testcontainers-go"
+	tcexec "github.com/testcontainers/testcontainers-go/exec"
 	"github.com/testcontainers/testcontainers-go/wait"
 )
 
@@ -23,6 +24,15 @@ type ConfigData struct {
 	ServerAddr string
 }
 
+// ExecOutput runs cmd in c and returns the demultiplexed output reader.
+// testcontainers' Exec returns the raw Docker stream, which multiplexes stdout
+// and stderr with 8-byte framing headers (type byte + 6 zero + length) that
+// interleave with the real data. Demultiplexing produces a clean combined
+// stdout+stderr stream that tests can assert against.
+func ExecOutput(ctx context.Context, c testcontainers.Container, cmd []string) (int, io.Reader, error) {
+	return c.Exec(ctx, cmd, tcexec.Multiplexed())
+}
+
 func DumpLogs(t *testing.T, ctx context.Context, label string, c testcontainers.Container) {
 	logs, err := c.Logs(ctx)
 	if err != nil {
@@ -294,9 +304,7 @@ func runGostContainer(ctx context.Context, networkName, yamlPath string, aliases
 			},
 		},
 		ExposedPorts: exposedPorts,
-		// internal check for udp ports will be failed
-		WaitingFor: wait.ForExposedPort().SkipInternalCheck(),
-		Networks:   []string{networkName},
+		Networks:     []string{networkName},
 		NetworkAliases: map[string][]string{
 			networkName: aliases,
 		},
@@ -304,6 +312,16 @@ func runGostContainer(ctx context.Context, networkName, yamlPath string, aliases
 		Cmd:   []string{"/bin/gost", "-C", "/config.yaml"},
 	}
 
+	// Wait for the gost process to be ready. With exposed ports we wait for the
+	// port to accept connections; without them (e.g. a socks5 proxy consumed
+	// from inside the container) we wait for a startup log line instead.
+	if len(exposedPorts) > 0 {
+		// internal check for udp ports will be failed
+		req.WaitingFor = wait.ForExposedPort().SkipInternalCheck()
+	} else {
+		req.WaitingFor = wait.ForLog("listening on")
+	}
+
 	return testcontainers.GenericContainer(ctx, testcontainers.GenericContainerRequest{
 		ContainerRequest: req,
 		Started:          true,