feat(kuma-cp): improve BuildRules algorithm

[lobkovilya]

While implementing targetRef.Kind: MeshHTTPRoute I've encountered the problem when BuildRules returns excessive results because I'm adding an artificial tag __route_hash__ to the Subset.

But the problem could be noticed even for the given MeshTrafficPermission policy:

type: MeshTrafficPermission
spec:
  targetRef:
    kind: Mesh
  from:
    - targetRef:
        kind: MeshService
        name: frontend
      default:
        action: Allow
    - targetRef:
        kind: MeshServiceSubset
        name: backend
        tags:
          version: v1
      default:
        action: Deny

the algorithm is going to produce 2 excessive rules:

rules:
  - subset:
      kuma.io/service: frontend
      version: v1
    conf:
      action: Allow
  - subset:
      kuma.io/service: frontend
      version: !v1 # not 'v1'
    conf:
      action: Allow

The algorithm splits frontend service into v1 and not v1 but there is absolutely no reason for that. This happens because the current algorithm assumes that all provided rules could have an intersection. The new algorithm takes this into account. As a result, we're going to produce fewer rules, for example:

type: MeshTrafficPermission
spec:
  targetRef:
    kind: Mesh
  from:
    - targetRef:
        kind: MeshService
        name: frontend_kuma-demo_svc_8080
      default:
        action: Allow
    - targetRef:
        kind: MeshServiceSubset
        name: backend_kuma-demo_svc_3001
        tags:
          team: mesh
          zone: east
          env: dev
      default:
        action: Deny

Old algorithm Inspect API:

New algorithm Inspect API:

Checklist prior to review

• Link to relevant issue as well as docs and UI issues --
• This will not break child repos: it doesn't hardcode values (.e.g "kumahq" as a image registry) and it will work on Windows, system specific functions like syscall.Mkfifo have equivalent implementation on the other OS --
• Tests (Unit test, E2E tests, manual test on universal and k8s) --
• Do you need to update UPGRADE.md? --
• Does it need to be backported according to the backporting policy? --
• Do you need to explicitly set a > Changelog: entry here or add a ci/ label to run fewer/more tests?