fix(egress): make SO_MARK best-effort for non-privileged environments

SO_MARK requires CAP_NET_ADMIN which is unavailable in CI runners
and development environments. The mark is only needed when iptables
transparent redirect is active (container runtime), so silently
ignore the error elsewhere.

Author: Pangjiping

components/egress/pkg/credentialvault/source_http_transport_linux.go

@@ -28,13 +28,13 @@ import (
 func httpSourceTransport() http.RoundTripper {
 	dialer := defaultTransportDialer()
 	dialer.Control = func(network, address string, c syscall.RawConn) error {
-		var opErr error
-		if err := c.Control(func(fd uintptr) {
-			opErr = unix.SetsockoptInt(int(fd), unix.SOL_SOCKET, unix.SO_MARK, constants.MarkValue)
-		}); err != nil {
-			return err
-		}
-		return opErr
+		_ = c.Control(func(fd uintptr) {
+			// Best-effort: requires CAP_NET_ADMIN. In environments without
+			// iptables transparent redirect (tests, dev), the mark is
+			// unnecessary and the error is harmless.
+			_ = unix.SetsockoptInt(int(fd), unix.SOL_SOCKET, unix.SO_MARK, constants.MarkValue)
+		})
+		return nil
 	}
 	return &http.Transport{DialContext: dialer.DialContext}
 }