xds/rbac: apply header matcher checks to nested and/or/not rules

[nvxbug]

parseConfig only walks the top-level Permissions and Principals of each RBAC policy when it applies the A41 header-name rules, so a header matcher nested inside an and_rules, or_rules, or not_rule is never checked. A control plane can put a :scheme or grpc- prefixed matcher inside a nested rule to slip past the validation A41 says must reject it, and a nested host matcher never gets rewritten to :authority, so it silently fails to match the header grpc-go actually carries (a deny policy on a nested host matcher fails open).

Walk the full permission and principal trees so both the :scheme/grpc- rejection and the host to :authority rewrite reach matchers at any depth. Doing it in parseConfig keeps the check in the one place that already owns A41 validation, and folds the two former top-level passes into a single recursive walk shared by permissions and principals.

RELEASE NOTES:

• xds/rbac: Fix a bug where nested Principal or Permission rules with :scheme or grpc- prefixed header matchers were not rejected, which could cause DENY rules to fail open.
• xds/rbac: Fix a bug where the host header matcher was not being replaced with :authority in nested Principal or Permission rules.

[codecov]

Codecov Report

❌ Patch coverage is 86.66667% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 83.15%. Comparing base (25387aa) to head (d87ef3f).
⚠️ Report is 36 commits behind head on master.

Files with missing lines	Patch %	Lines
internal/xds/httpfilter/rbac/rbac.go	86.66%	5 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #9258      +/-   ##
==========================================
- Coverage   83.30%   83.15%   -0.15%     
==========================================
  Files         420      423       +3     
  Lines       34106    35261    +1155     
==========================================
+ Hits        28413    29323     +910     
- Misses       4260     4427     +167     
- Partials     1433     1511      +78     

Files with missing lines	Coverage Δ
internal/xds/httpfilter/rbac/rbac.go	73.33% <86.66%> (+10.66%)	⬆️

... and 57 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[nvxbug]

gentle ping

[easwars]

LGTM, modulo couple of minor nits

[easwars]

Nit: Can we split the check so that we get a finer grained error and use %q formatting directive:

	if name == ":scheme" {
		return fmt.Errorf("rbac: header matcher for %q is %q", name, ":scheme")
	}
	if strings.HasPrefix(name, "grpc-") {
		return fmt.Errorf("rbac: header matcher for %q starts with %q", name, "grpc-")
	}

[nvxbug]

Done, split into two checks with %q.

[easwars]

Nit: here and down below s/nested/Nested

[nvxbug]

Done, capitalized both.

[easwars]

@nvxbug Thank you for your contribution!