Egresspolicy impl - #1545

The egress ext_proc handler is about to authorize every request inside
every tunnel against the actor's EgressPolicy. Fetching that policy from
ateapi per request would put the control plane on the data path, so it
is read through a per-actor cache instead.

The TTL is exactly how stale a decision can be: a create, update or
delete is visible to new requests within one TTL, and a deletion becomes
a deny. "No policy" is cached like a policy is, because deny-by-default
is the answer a flood of refused requests hits. A failed fetch is never
cached, so an ateapi outage fails only the requests it overlaps.
Concurrent fetches of one actor's policy are collapsed into a single
call, and that call outlives the caller that started it, so the burst an
actor sends the moment it wakes up costs one round trip. Expired entries
are removed once the live set has doubled, so a gateway that has seen many
actors does not keep a policy for each of them forever.

…owed

The handler decides address rules at the CONNECT and every readable
request on its Host and the dialed address, so both gateways have to
give it those legs and act on what it decided.

The CONNECT chain's ext_proc may answer with dynamic metadata, and the
gateway admits exactly one namespace of it, dev.ate.egress. A
set_filter_state filter placed after the ext_proc copies
dev.ate.egress:passthrough_destination into Envoy's
envoy.network.transport_socket.original_dst_address and shares it with
the upstream connection. That is the whole mechanism carrying the
decision from the process that made it to the socket that acts on it,
with no header anywhere in between.

Inside the tunnel a connection lands on one of three chains, chosen by
tls_inspector and http_inspector under the 1s timeout that already
governs sdsmint:

  * egress_cleartext, on both gateways, matches raw_buffer with an HTTP
    ALPN and runs the policy ext_proc on every request. Its answer,
    dev.ate.egress:dial, picks the route: name goes to the
    dynamic_forward_proxy cluster, which resolves the Host, and address
    to an ORIGINAL_DST cluster fed by the same filter state as the
    passthrough chains, so the bytes go to what the matching rule
    checked. There is no route without a dial, and the answer clears the
    route cache, because Envoy picks a route before the filter runs. The
    chain accepts HTTP/1.0, which http_inspector steers here and the
    codec used to refuse before any filter ran.
  * egress_tls_mitm, sdsmint only, is that same per-request check and
    routing on the requests the gateway decrypted. Both of its dials
    re-originate TLS with the SNI and certificate check taken from the
    Host, so a Host the dialed origin cannot prove fails the handshake.
    Its filter sits below the existing #ATE_MITM_EXTPROC_FILTER markers,
    which keep working for an external processor spliced in by the
    installer.
  * the passthrough chains take what is left: on the plain gateway TLS it
    will not terminate, and on both gateways anything the inspectors
    could not classify, a client that said nothing before the timeout
    included. They run no filter. Their tcp_proxy points at an
    ORIGINAL_DST cluster with no address of its own, so it dials whatever
    the CONNECT decision put in filter state and closes the connection
    when there is nothing there. A destination no address rule allowed is
    therefore unreachable for traffic the gateway cannot read, which is
    what makes deferring a decision to the request legs safe.

    There is one such chain per transport protocol rather than a single
    chain matching nothing, because Envoy buckets filter chains by
    transport protocol and never falls out of a bucket that exists. With
    egress_cleartext holding the raw_buffer bucket and filling it with
    HTTP application protocols alone, a chain matching nothing would be
    unreachable and every opaque or unclassified connection would be
    closed as no_filter_chain_match, address rule or not. A manifest test
    now pins the invariant that each transport protocol the inspectors
    set has a chain, and that each has one catching what they could not
    name.

The plain gateway gains the inner listener it never had; until now it
spliced the tunnel straight to the IP:port and could police nothing
inside it. Its TLS stays end to end encrypted, since there is no MITM CA
there, so what it can enforce for HTTPS is the address, which the
manifest says in as many words. Server-speaks-first protocols pay the 1s
sniff timeout on this gateway now, as they already did on sdsmint.

The outer hop's connection pool is keyed per actor through
envoy.network.upstream_server_name, set from the same verified
certificate as the identity. Envoy captures shared filter state when a
pool is created and a string object takes no part in the pool's key, so
without that key a second actor's tunnel could be handed a pool carrying
the first actor's identity. The clusters that target an internal
listener also cap themselves at one request per connection.

The manifest tests pin the chain names, the attributes each ext_proc
requests, the metadata namespace every leg may answer in, the filter
that turns the CONNECT leg's answer into the passthrough address and the
absence of any other writer of that key, the two routes each request leg
has and the clusters they select, and a distinct stat_prefix per
ext_proc, because a mismatch fails closed at runtime and nothing else
would notice.

The egress gateway now refuses every tunnel for an actor without an
EgressPolicy, so every e2e actor that egresses needs one. A new
e2e.EnsureEgressPolicy creates or replaces an actor's policy, and the
networking and egressmitm suites give their actors an allow-all rule at
creation, which keeps every existing egress test meaning what it meant.

The cases cover the policy itself. An actor whose policy names one
hostname is refused with 403 and "egress denied" when it asks for
another over cleartext HTTP, and for the same origin by address, since
an IP-literal Host names no host. An actor with no policy gets no tunnel
at all, which the demo app reports as a 502 from a failed connect. A
policy naming the origin's address admits a plain HTTP request to it
both by address and by name, because the request is decided on the
address the actor dialed, and it gets no tunnel for a name that resolves
anywhere else. Over HTTPS an address policy admits example.com on both
gateways: the plain gateway by address at the CONNECT, sdsmint on the
decrypted request, which it then sends to the dialed address with the
certificate checked against the name.

The one case where the gateways differ is a hostname policy over HTTPS,
and it is two tests, one per gateway, each skipping on the other.
sdsmint reads the decrypted request, so it admits the named host and
answers 403 for another; the plain gateway cannot read TLS and no
address rule allows either destination, so it closes both connections
before a byte reaches an origin. E2E_EGRESS_MITM tells the suite which
gateway it is running against. The egressmitm suite adds the same 403
to its probe, next to the trust-bundle assertions it already makes.

…y leg

The router README gets the gateway-side account, a leg at a time,
including the metadata that carries the CONNECT leg's decision to the
chain that dials. The egress demo README stops calling destination
authorization a follow-up.