feat(epe): add caller-supplied destination egress policy filter

[Kuromesi]

Summary

Add an EPE egresspolicy filter that authorizes the actual destination supplied by its caller. A caller can pass 10.20.1.2:443 for either CONNECT or ordinary HTTP and get the same CIDR/port decision, regardless of the request's authority or Host header.

The filter compiles ordered allow/deny rules with IPv4/IPv6 CIDRs, individual ports, and inclusive port ranges. It defaults to deny, rejects missing or invalid destinations, and continues the remaining filter chain when allowed. engine.Resolution.Destination carries the caller's target through ext_proc into filter.Stream.Destination; the filter does no protocol-specific extraction or DNS resolution.

Includes a standalone JSON configuration and integration instructions. Callers explicitly register egresspolicy.Definition() and supply its payload and actual target. This change does not extend the SecurityProfile CRD or enable the filter in default production wiring.

Validation

• go test ./extensions/epe/...
• ./bin/lint_copyright_kruise.sh upstream/master
• Scripted ext_proc scenarios cover CONNECT/GET/POST, conflicting authority, allow/deny, missing destination, and continued enforcement by a later filter.

Real gateway tunnel traffic and live policy updates have not been tested.

[kruise-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment