egress: add credential injector

[yufan-su]

Depends on #1335 , delta is in commit 1fba8ec

What this adds

atenet egress-inject, an ext_proc server the egress gateway's decrypted MITM leg dials. For each outbound request it:

• fetches the requesting actor's egress policy from ateapi (GetActorEgressPolicy),
• matches the destination host against the policy's hostnames rules, and
• on a matching rule with a credential injection, fetches the secret from credprovider and sets it as a request header (e.g. Authorization: Bearer ).

Installation

One flag stands up and wires the whole stack:

hack/install-ate.sh --deploy-ate-system --experimental-egress-credential-injection

--experimental-egress-credential-injection deploys credprovider and the injector, then re-wires the sdsmint egress gateway to route through the injector. It implies --experimental-use-sdsmint

New install flags

Two flags configure which credential provider the injector targets:

Flag	Purpose	Default
--credential-provider-name	Provider class, as a substrate-secret:// prefix; a policy URI of any other class is refused	substrate-secret://kubernetes.io
--credential-provider-address	Where the injector dials the provider	credprovider.ate-system.svc:50051