ext_authz: option to not charge cluster response code (#29841)

Signed-off-by: Paul Ogilby <pgal@google.com>

Mirrored from https://github.com/envoyproxy/envoy @ 6538c486d4d317c94f1127821313ea36cdd7d6d5

envoy/extensions/filters/http/ext_authz/v3/ext_authz.proto

@@ -10,6 +10,8 @@ import "envoy/type/matcher/v3/metadata.proto";
 import "envoy/type/matcher/v3/string.proto";
 import "envoy/type/v3/http_status.proto";
 
+import "google/protobuf/wrappers.proto";
+
 import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/sensitive.proto";
 import "udpa/annotations/status.proto";
@@ -26,7 +28,7 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
 // External Authorization :ref:`configuration overview <config_http_filters_ext_authz>`.
 // [#extension: envoy.filters.http.ext_authz]
 
-// [#next-free-field: 20]
+// [#next-free-field: 21]
 message ExtAuthz {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.config.filter.http.ext_authz.v2.ExtAuthz";
@@ -197,6 +199,10 @@ message ExtAuthz {
   // When this field is true, Envoy will include the SNI name used for TLSClientHello, if available, in the
   // :ref:`tls_session<envoy_v3_api_field_service.auth.v3.AttributeContext.tls_session>`.
   bool include_tls_session = 18;
+
+  // Whether to increment cluster statistics (e.g. cluster.<cluster_name>.upstream_rq_*) on authorization failure.
+  // Defaults to true.
+  google.protobuf.BoolValue charge_cluster_response_stats = 20;
 }
 
 // Configuration for buffering the request data.