Redact http header values in logs

[sfc-gh-elinardi]

Introducing redaction to rpc authz evaluation logs.

This leverages protobuf's debug_redact annotation. In the protobuf definition, fields which need redaction are annotated with debug_redact. Then, before logging the protobuf message, we look for the annotation and replace the value with --REDACTED--

In this PR I'm only adding the redaction to httpoverrpc header values.

Testing

{"logger":"sansshell-proxy","ts":"2023-10-09 14:17:51.528922","caller":{"file":"rpcauth.go","line":215},"level":2,"msg":"evaluating authz policy","method":"/Proxy.Proxy/Proxy","peer":{"net":{"network":"tcp","address":"127.0.0.1","port":"64348"},"cert":{"subject":"CN=test.example.com","issuer":"CN=example.com","dnsnames":["test.example.com"],"spiffeid":""},"principal":null},"input":{"method":"/HTTPOverRPC.HTTPOverRPC/Host","message":{"request":{"method":"POST", "request_uri":"/session", "headers":[{"key":"Content-Type", "values":["--REDACTED--"]}, {"key":"Accept", "values":["--REDACTED--"]}, {"key":"User-Agent", "values":["--REDACTED--"]}, {"key":"Authorization", "values":["--REDACTED--"]}]}, "port":8082, "hostname":"localhost", "protocol":"http"},"type":"HTTPOverRPC.HostHTTPRequest","metadata":{":authority":["test.example.com"],"content-type":["application/grpc"],"user-agent":["grpc-go/1.52.3"],"grpc-accept-encoding":["gzip"]},"peer":{"net":{"network":"tcp","address":"127.0.0.1","port":"64348"},"cert":{"subject":"CN=test.example.com","issuer":"CN=example.com","dnsnames":["test.example.com"],"spiffeid":""},"principal":null},"host":{"net":{"network":"tcp","address":"127.0.0.1","port":"50042"},"cert":{"subject":"CN=test.example.com","issuer":"CN=example.com","dnsnames":["test.example.com"],"spiffeid":""},"principal":null},"environment":{"non_host_policy_check":true},"extensions":null}}
{"logger":"sansshell-proxy","ts":"2023-10-09 14:17:51.529090","caller":{"file":"rpcauth.go","line":237},"level":2,"msg":"evaluating authz policy post hooks","method":"/Proxy.Proxy/Proxy","peer":{"net":{"network":"tcp","address":"127.0.0.1","port":"64348"},"cert":{"subject":"CN=test.example.com","issuer":"CN=example.com","dnsnames":["test.example.com"],"spiffeid":""},"principal":null},"input":{"method":"/HTTPOverRPC.HTTPOverRPC/Host","message":{"request":{"method":"POST", "request_uri":"/session", "headers":[{"key":"Content-Type", "values":["--REDACTED--"]}, {"key":"Accept", "values":["--REDACTED--"]}, {"key":"User-Agent", "values":["--REDACTED--"]}, {"key":"Authorization", "values":["--REDACTED--"]}]}, "port":8082, "hostname":"localhost", "protocol":"http"},"type":"HTTPOverRPC.HostHTTPRequest","metadata":{"user-agent":["grpc-go/1.52.3"],"grpc-accept-encoding":["gzip"],":authority":["test.example.com"],"content-type":["application/grpc"]},"peer":{"net":{"network":"tcp","address":"127.0.0.1","port":"64348"},"cert":{"subject":"CN=test.example.com","issuer":"CN=example.com","dnsnames":["test.example.com"],"spiffeid":""},"principal":null},"host":{"net":{"network":"tcp","address":"127.0.0.1","port":"50042"},"cert":{"subject":"CN=test.example.com","issuer":"CN=example.com","dnsnames":["test.example.com"],"spiffeid":""},"principal":null},"environment":{"non_host_policy_check":true},"extensions":null}}
{"logger":"sansshell-proxy","ts":"2023-10-09 14:17:51.529295","caller":{"file":"rpcauth.go","line":255},"level":0,"msg":"authz policy evaluation result","method":"/Proxy.Proxy/Proxy","peer":{"net":{"network":"tcp","address":"127.0.0.1","port":"64348"},"cert":{"subject":"CN=test.example.com","issuer":"CN=example.com","dnsnames":["test.example.com"],"spiffeid":""},"principal":null},"authorizationResult":true,"input":{"method":"/HTTPOverRPC.HTTPOverRPC/Host","message":{"request":{"method":"POST", "request_uri":"/session", "headers":[{"key":"Content-Type", "values":["--REDACTED--"]}, {"key":"Accept", "values":["--REDACTED--"]}, {"key":"User-Agent", "values":["--REDACTED--"]}, {"key":"Authorization", "values":["--REDACTED--"]}]}, "port":8082, "hostname":"localhost", "protocol":"http"},"type":"HTTPOverRPC.HostHTTPRequest","metadata":{"user-agent":["grpc-go/1.52.3"],"grpc-accept-encoding":["gzip"],":authority":["test.example.com"],"content-type":["application/grpc"]},"peer":{"net":{"network":"tcp","address":"127.0.0.1","port":"64348"},"cert":{"subject":"CN=test.example.com","issuer":"CN=example.com","dnsnames":["test.example.com"],"spiffeid":""},"principal":null},"host":{"net":{"network":"tcp","address":"127.0.0.1","port":"50042"},"cert":{"subject":"CN=test.example.com","issuer":"CN=example.com","dnsnames":["test.example.com"],"spiffeid":""},"principal":null},"environment":{"non_host_policy_check":true},"extensions":null},"denialHints":[]}

[sfc-gh-srhodes]

Looks okay overall. Could you add tests for getRedactedInput()?

[sfc-gh-elinardi]

Looks okay overall. Could you add tests for getRedactedInput()?

Added tests for getRedactedInput