Add fundamental building blocks for zero-trust (certificate manager, authentication) as part of traffic governance module | 流量治理-零信任模块实现

[xinlunanxinlunan]

Describe what this PR does / why we need it

With the development of cloud-native technologies, network boundaries are gradually disappearing, and the concept of zero trust therefore prevails. The most important functions of zero trust are certificate management and request authentication. As a generic, cloud-native traffic governance component, Sentinel 2.0 will support zero-trust capabilities for certificate management and request authentication:

• Obtain the certificate from the external data source and use it to configure https when the web service is enabled.

• Obtains authentication rules from the external data source and permits or blocks each request based on the authentication rules.

Does this pull request fix one issue?

Resolves #3166

Describe how you did it

1. Add a sentinel-security-core module for:
   • Certificates and authentication rule management
   • Authentication rules include ALLOW rules, DENY rules, and JWT rules, which are the same as those in Istio
   • The authenticator will be placed in the core and used to determine whether the request should be allowed or blocked.

The specific rules are:

• (1) If there is a JWT rule matching the request, the request is matched. If the matching result is rejected, the request is rejected.
• (2) If any DENY policy matches the request, the request is denied.
• (3) ALLOW the request if the workload does not have an Allow policy.
• (4) ALLOW any Allow policy if it matches the request.

Istio authentication rules: https://istio.io/latest/docs/reference/config/security/authorization-policy/

2. Extension module: We will temporarily use istio as the external data source:
   • Send a CSR with a k8s token to istio to get a certificate.
   • You can obtain authentication rules by subscribing to istio's xds in batches.
3. Adatper module: Add sentinel certificates and authentication rules to the existing application framework adaptation module, and support microservice zero trust.

Describe how to verify it

1. Modify the corresponding namespace podName in file sentinel-extension/sentinel-datasource-xds/src/test/java/com/alibaba/csp/sentinel/datasource/xds/util/TestUtil.java.

2. Change the token in file sentinel-extension/sentinel-datasource-xds/src/test/resources/token,
   and token path in istio-proxy

cat /var/run/secrets/tokens/istio-token

3. Change the root-cert.pem in file sentinel-extension/sentinel-datasource-xds/src/test/resources/root-cert.pem，and root-cert.pem path in istio-proxy

cat /var/run/secrets/istio/root-cert.pem

4. Modify istiod.istio-system.svc in local /etc/hosts.

5. Go test.

Special notes for reviews

[CLAassistant]

All committers have signed the CLA.

[sczyh30]

LGTM

[sczyh30]

For committers: please use "create a merge commit" mode for this.

[LearningGp]

LGTM