exam images - replace squid with privoxy, add SSL bumping

Replace squid with privoxy, mostly because it's not marked insecure by nixpkgs.

Rules are fetched at runtime so it can easily be changed without rebuilding images.

Adds SSL bumping to add ability to filter traffic based on path, instead of host only. I'm still unsure about the security implications of having the CA keys in this repository (or having them bundled in the image at build time) instead of generating them at boot time.