tls: add option to set signature algorithms (#26167)

Add a new optional field to TlsParameters to configure signature algorithms.
The value is used during TLS handshake in TLS Signature Algorithms extension.
It indicates which signature algorithms may be used for digital signatures.
The value can be used for both DownstreamTlsContext and UpstreamTlsContext.

Signed-off-by: Tero Saarni <tero.saarni@est.tech>

Mirrored from https://github.com/envoyproxy/envoy @ 084794dd06c36edbcb27e05dc06c9d56a72b403f

envoy/extensions/transport_sockets/tls/v3/common.proto

@@ -24,6 +24,7 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
 
 // [#protodoc-title: Common TLS configuration]
 
+// [#next-free-field: 6]
 message TlsParameters {
   option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.auth.TlsParameters";
 
@@ -120,6 +121,42 @@ message TlsParameters {
   //
   //   P-256
   repeated string ecdh_curves = 4;
+
+  // If specified, the TLS connection will only support the specified signature algorithms.
+  // The list is ordered by preference.
+  // If not specified, the default signature algorithms defined by BoringSSL will be used.
+  //
+  // Default signature algorithms selected by BoringSSL (may be out of date):
+  //
+  // .. code-block:: none
+  //
+  //   ecdsa_secp256r1_sha256
+  //   rsa_pss_rsae_sha256
+  //   rsa_pkcs1_sha256
+  //   ecdsa_secp384r1_sha384
+  //   rsa_pss_rsae_sha384
+  //   rsa_pkcs1_sha384
+  //   rsa_pss_rsae_sha512
+  //   rsa_pkcs1_sha512
+  //   rsa_pkcs1_sha1
+  //
+  // Signature algorithms supported by BoringSSL (may be out of date):
+  //
+  // .. code-block:: none
+  //
+  //   rsa_pkcs1_sha256
+  //   rsa_pkcs1_sha384
+  //   rsa_pkcs1_sha512
+  //   ecdsa_secp256r1_sha256
+  //   ecdsa_secp384r1_sha384
+  //   ecdsa_secp521r1_sha512
+  //   rsa_pss_rsae_sha256
+  //   rsa_pss_rsae_sha384
+  //   rsa_pss_rsae_sha512
+  //   ed25519
+  //   rsa_pkcs1_sha1
+  //   ecdsa_sha1
+  repeated string signature_algorithms = 5;
 }
 
 // BoringSSL private key method configuration. The private key methods are used for external