feat(xds): auto reachable services based on MeshTrafficPermission

[jakubdyszkiewicz]

Checklist prior to review

This PR introduces auto reachable services based on MeshTrafficPermission described here #8084

I introduced a concept of reachable services graph which is just an interface in "core" xds_context package and default implementation that any service can reach any other service. Then in MTP plugin I created implementation based on MTP which is wired up in bootstrap. This way we avoid cyclic dependency and dependency on plugins, MTP, matching in xds_context.

At first, I created graph of service to service, but then we figured out that subset (MeshSubset / MeshServiceSubset) support is quite critical therefore the graph keeps list of rules for every service which can be evaluated by every DPP. This means that we support subsets fully in from section. In top level target ref it's impossible to support all subsets because client won't know which instance of the server it will reach. therefore we decided to support only predefined tags that we know are autogenerated and stable for all instances (which is k8s.kuma.io/*). We could have supported any common tag between instances but it would then require to call replaceSubsets function for every single service.

This is opt-in experimental feature.

It is not fully clear what is the impact on perf here. We will investigate this.

Existing reachable services takes precedence over the graph.

Todo as a follow-up

• A way to inspect generated graph, possibly with inspect endpoints.

• Link to relevant issue as well as docs and UI issues --
• This will not break child repos: it doesn't hardcode values (.e.g "kumahq" as a image registry) and it will work on Windows, system specific functions like syscall.Mkfifo have equivalent implementation on the other OS --
• Tests (Unit test, E2E tests, manual test on universal and k8s) --
  • Don't forget ci/ labels to run additional/fewer tests
• Do you need to update UPGRADE.md? --
• Does it need to be backported according to the backporting policy? (this GH action will add "backport" label based on these file globs, if you want to prevent it from adding the "backport" label use no-backport-autolabel label) --