internal/envoy: switch HeaderMatch to SafeRegex

[davecheney]

Updates #1351

nb. there appear to be no internal/contour, internal/e2e, or
internal/featuretest tests for header contains matching. I've raised
#1880 to track this.

Signed-off-by: Dave Cheney dave@cheney.net

[stevesloka]

Fixes #1513

[jpeach]

IIUC regexes are exposed to users through Ingress? If so, we should document the change in regex engine? I recalled that RE2 has some slightly different syntax, but maybe I'm misremembering because I can't find it now.

[davecheney]

IIUC regexes are exposed to users through Ingress? If so, we should document the change in regex engine? I recalled that RE2 has some slightly different syntax, but maybe I'm misremembering because I can't find it now.

Yup. This misfeature of ingress is categorically the worse. Envoy offers Re2 but the Ingress spec says the regex engine is extended POSIX as defined by IEEE Std 1003.1. Luckily not many people seem to know that Ingress's path spec is a regex.

Now you're starting to understand why I really really really don't want to expose regex in any form via contour.

[jpeach]

LGTM