feat: per-request backend credentials from request headers and dynamic metadata

[kanurag94]

Description

BackendSecurityPolicy today uses one static credential for every request. This adds an optional credentialOverride field so a trusted upstream filter can supply the credential per-request instead.

Two sources: fromRequestHeaders reads from a request header the filter injects (stripped before forwarding upstream), fromDynamicMetadata reads from Envoy filter metadata which the client cannot forge. fallbackToConfigured decides whether a missing source falls back to the static credential or returns 401.

Default header names use the x-aigw- prefix (e.g. x-aigw-api-key) so they don't collide with real provider headers and are redacted from logs automatically. AWSCredentials is not supported here — it needs three values plus SigV4 signing, that's a separate follow-up.

Example with header source, falls back to the secret when header is absent:

spec:
  type: APIKey
  apiKey:
    secretRef:
      name: openai-key
  credentialOverride:
    fromRequestHeaders:
      fallbackToConfigured: true

Example with dynamic metadata, 401 when key is missing:

  credentialOverride:
    fromDynamicMetadata:
      namespace: envoy.filters.http.ext_authz
      key: upstream_api_key
      fallbackToConfigured: false

Related Issues/PRs (if applicable)

Closes #2216
Related: #2076

Special notes for reviewers (if applicable)

The fromRequestHeaders source strips the input header from the request before it reaches the upstream backend. This is done by adding it to the backend's HeaderMutation.Remove list, which tells Envoy to drop it while keeping it visible in the local header map so the handler can still read it.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 81.31868% with 34 lines in your changes missing coverage. Please review.
✅ Project coverage is 84.70%. Comparing base (4ae1ec4) to head (0b5576e).

Files with missing lines	Patch %	Lines
internal/controller/gateway.go	74.48%	21 Missing and 4 partials ⚠️
internal/backendauth/credential_override.go	90.19%	3 Missing and 2 partials ⚠️
internal/backendauth/auth.go	83.33%	3 Missing and 1 partial ⚠️

Additional details and impacted files

@@           Coverage Diff            @@
##             main    #2253    +/-   ##
========================================
  Coverage   84.70%   84.70%            
========================================
  Files         144      145     +1     
  Lines       21204    21337   +133     
========================================
+ Hits        17960    18073   +113     
- Misses       2162     2177    +15     
- Partials     1082     1087     +5     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[kanurag94]

/retest