Parse equal-preference cipher groups

[tsaarni]

This change corrects the parsing of cipher configuration by adding support for equal-preference cipher groups [cipher1|cipher2|...]:

• The ValidTLSCiphers list now contains only individual cipher names, not groups.
• When configuring a group, the group is split into individual ciphers before comparing against cipher names in valid TLS cipher list.
• User is now able to configure ciphers ECDHE-ECDSA-CHACHA20-POLY1305 and ECDHE-RSA-CHACHA20-POLY1305 individually, whereas previously they were only accepted as part of the hardcoded groups.
• User can now define their own equal-preference ciphers groups.

Fixes #6380

Background:

Prior this change the list of valid TLS ciphers had hardcoded ciphers in bracketed format

contour/apis/projectcontour/v1alpha1/ciphersuites.go

Lines 44 to 45 in 0796cd9

	"[ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]": {},
	"[ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305]": {},

This is simply a copy from Envoy documentation (link) but on further inspection Boringssl doc (link) says:

An equal-preference is specified with square brackets, combining multiple selectors separated by |. For example:
[TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256|TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256]

We should not use the hardcoded groups when validating user's cipher configuration, instead we should parse the groups into individual cipher names and validate them.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 81.63%. Comparing base (0796cd9) to head (8cf36b2).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #6461   +/-   ##
=======================================
  Coverage   81.63%   81.63%           
=======================================
  Files         133      133           
  Lines       15869    15869           
=======================================
  Hits        12955    12955           
  Misses       2620     2620           
  Partials      294      294           

[skriss]

LGTM, thanks @tsaarni

[sunjayBhatia]

nit: could use strings.Trim instead of the slice indexing here just to be safe: https://pkg.go.dev/strings#Trim

[sunjayBhatia]

could add a couple negative tests for the new parsing logic otherwise just one nit and lgtm, nice fix!

[tsaarni]

could add a couple negative tests for the new parsing logic otherwise just one nit and lgtm, nice fix!

Fixed!

Suddently codespell started to complain for unchanged files, although I thought codespell version in actions is fixed 😲 Anyways, I fixed the complaints.