feat: ext auth headers on match

[shreealt]

What type of PR is this?

Enhancement 😎

What this PR does / why we need it:

When using ext auth, it is a common scenario that users might need some specific headers (other then the default) to be sent to the auth service. The envoy go control plane supports matching headers based on StringMatch, we leverage this feature to assign headers to outgoing ext auth API call based on following matching types:

• Exact
• Prefix
• Suffix
• Regex

Which issue(s) this PR fixes:

Fixes #7703

Release Notes: Yes/No

[codecov]

Codecov Report

❌ Patch coverage is 43.47826% with 26 lines in your changes missing coverage. Please review.
✅ Project coverage is 72.77%. Comparing base (e2a495d) to head (db6fa91).

Files with missing lines	Patch %	Lines
internal/xds/translator/extauth.go	31.42%	24 Missing ⚠️
internal/gatewayapi/securitypolicy.go	81.81%	1 Missing and 1 partial ⚠️

❌ Your patch check has failed because the patch coverage (43.47%) is below the target coverage (60.00%). You can increase the patch coverage or adjust the target coverage.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7792      +/-   ##
==========================================
- Coverage   72.83%   72.77%   -0.06%     
==========================================
  Files         236      236              
  Lines       35190    35228      +38     
==========================================
+ Hits        25629    25638       +9     
- Misses       7742     7774      +32     
+ Partials     1819     1816       -3     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[zhaohuabing]

Nit: can we use ir.StringMatch here?

[shreealt]

those two structs are indeed quite different and using ir.StringMatch by going over the hassle for the data structure conversion does not really serve any real purpose.

[zhaohuabing]

Ideally, we should avoid using external APIs directly in the IR layer when possible, since the IR is meant to be an intermediate representation that’s independent of Envoy Gateway and the Gateway API.

That said, this isn’t blocking, as we’re already using some external APIs in the IR today.

[shreealt]

Pushed new changes, please review again!

[shreealt]

/retest