feat(xds): add internal address config onto HttpConnectionManager

[jijiechen]

Motivation

add internal address config onto HttpConnectionManager, more details are available in issue #12190

Implementation information

introducing a new configuration item ipam.knownInternalCIDRs on zonal CP to allow users specify their known internal address pool and we assign these values when generating Envoy config for HttpConnectionManager

Supporting documentation

fixes #12190

[github-actions]

Reviewer Checklist

🔍 Each of these sections need to be checked by the reviewer of the PR 🔍:
If something doesn't apply please check the box and add a justification if the reason is non obvious.

• Is the PR title satisfactory? Is this part of a larger feature and should be grouped using > Changelog?
• PR description is clear and complete. It Links to relevant issue as well as docs and UI issues
• This will not break child repos: it doesn't hardcode values (.e.g "kumahq" as an image registry)
• IPv6 is taken into account (.e.g: no string concatenation of host port)
• Tests (Unit test, E2E tests, manual test on universal and k8s)
  • Don't forget ci/ labels to run additional/fewer tests
• Does this contain a change that needs to be notified to users? In this case, UPGRADE.md should be updated.
• Does it need to be backported according to the backporting policy? (this GH action will add "backport" label based on these file globs, if you want to prevent it from adding the "backport" label use no-backport-autolabel label)

[lukidzi]

Can we add more test cases? I would like to see Gateway/ZoneEgress/ZoneIngress configuration change either by outbound_proxy generator, Mesh*Route. Also, what about admin_proxy_generator, prometheus_endpoint_generator?

[jijiechen]

This makes me think if we should always set this config, I'm trying to do so in the updated commits.

This introduces a lot of changes touching a wide range of files in which I only asserted the internal addresses are passed in via the Mesh*Route plugins. I'm leaving the value as blank/default in tests of other plugins since the feature is already tested from the all the levels:

• the HCM configurer itself (pkg/xds/envoy/listeners/v3/http_connection_manager_configurer_test.go)
• the FilterChainBuilder builder (pkg/xds/envoy/listeners/http_connection_manager_configurer_test.go)
• the Mesh*Route plugins (pkg/plugins/policies/meshhttproute/plugin/v1alpha1/plugin_test.go)
• the generators (pkg/xds/generator/proxy_template_profile_source_test.go)

[jijiechen]

We are using Envoy 1.32 in 2.10, and Envoy 1.32 removed the default builtin internal addresses. So this PR is better to be merged in this 2.10 release.
Source: https://github.com/envoyproxy/envoy/blob/main/source/extensions/filters/network/http_connection_manager/config.cc#L83-L86

[lukidzi]

LGTM