Egress tunnel capture + agent identity

[Nina Polshakova (npolshakova)]

POC for #126

Based on design discussed in https://docs.google.com/document/d/1KmpIFu2gnqy9gp95wASgIo_vkJ_dA1DZckV8upET6bs/edit?usp=sharing

• Tests pass
• Appropriate changes to documentation are included in the PR

Summary:
This is a proof of concept egress capture path for actors. It introduces a reusable internal/egresscapture package that:

• starts local capture listeners
• drives the CONNECT authority from HTTP Host or TLS SNI, and opens a CONNECT-style tunnel to a configured PEP address.

The gVisor and microvm runtimes wire this into actor network setup by redirecting actor HTTP/HTTPS egress traffic to local capture ports. Agentgateway is used as the receiving proxy to prove that captured actor traffic reaches the tunnel endpoint.

Notes:

• Tested the gvisor setup, still need to test the MicroVM set up end to end
• Agent identity is currently passed as unsigned metadata headers:
  • x-ate-actor-id
  • x-ate-actor-template
  • x-ate-actor-template-namespace
  • x-ate-original-destination
  • x-ate-connect-authority
• Signed agent/actor identity is out of scope for this PR and should replace the current metadata headers approach once agent identity goes in [Feature] Actor Identity #124
• PEP control plane is out of scope of this PR (just using agentgateway to prove out the proxy gets traffic from the tunnel)

[Shashank (shashankram)]

Why do you need to capture HTTP vs HTTPS separately? A single listener could handle both and since SO_ORIGINAL_DST is used anyway to lookup the original port in deriveConnectAuthority.