Dependabot and private Go proxies: how they work and why it matters