Better rule matching

[josephschorr]

Adds support for CEL expression if statements that must be true for a rule to be used

[vroldanbet]

LGTM. My primary concern is ending up with a partial list of filtered rules due to a corner case in the rule if condition. For example, a request may end up with 2 out of 3 rules, because someone manipulated the request body in a way we did not anticipate. As a consequence, the request has a partial enforcement of rules, and could escalate privileges.

[josephschorr]

LGTM. My primary concern is ending up with a partial list of filtered rules due to a corner case in the rule if condition. For example, a request may end up with 2 out of 3 rules, because someone manipulated the request body in a way we did not anticipate. As a consequence, the request has a partial enforcement of rules, and could escalate privileges.

If no rules match, then it would fail closed. There is a risk, as you mentioned, that the "wrong" rule could be used, but that's less likely.