rlqs: implement preview matchers

[bsurber]

Commit Message:

• Preview matchers are provided to enable testing how a config would have treated incoming traffic.
  • The preview matcher tree and the actionable matcher tree are both checked against each incoming request.
  • The selected, actionable matcher will always determine the allow/deny decision for the request.
  • The preview matcher will go through full evaluation (bucket usage caching, etc) but the resulting allow/deny decision will not be enforced.
    • Preview matching & evaluation will populate dynamic metadata to make test results visible on the Envoy and the RLQS server will see usage reports, generate responses, etc as normal for server-side visibility.
• Both the actionable and preview matchers are given an optional priority value, to determine behavior when both the actionable and preview matchers match on a given request.
  • If the selected, actionable matcher has higher priority, then the preview matcher will not be evaluated.
  • If both have the same priority or the preview matcher has higher priority, then both matchers will be evaluated fully.
• A remaining TODO is to consider cases where the preview and actionable matchers point to the same bucket-id, as currently this gets reported as 2 separate requests to the same bucket. This can be addressed in a number of ways but deduping has a non-zero cost, so the first implementation is starting with the simplest option (no special-case handling).

Risk Level:
Testing: Unit testing, manual testing WIP
Docs Changes:
Release Notes:
Platform Specific Features:

[repokitteh-read-only]

As a reminder, PRs marked as draft will not be automatically assigned reviewers,
or be handled by maintainer-oncall triage.

Please mark your PR as ready when you want it to be reviewed!

🐱

Caused by: #37900 was opened by bsurber.

see: more, trace.

[repokitteh-read-only]

CC @envoyproxy/api-shepherds: Your approval is needed for changes made to (api/envoy/|docs/root/api-docs/).
envoyproxy/api-shepherds assignee is @markdroth
CC @envoyproxy/api-watchers: FYI only for changes made to (api/envoy/|docs/root/api-docs/).

🐱

Caused by: #37900 was opened by bsurber.

see: more, trace.

[bsurber]

Please squash-and-merge when ready, as Commit f521fc8 is a duplicate of the changes from PR #37851 and not needed.

[bsurber]

@sergiitk CC to review the proto changes