rbac: not permission/principal matcher (#3801)

Signed-off-by: Chris Roche <croche@lyft.com>

Mirrored from https://github.com/envoyproxy/envoy @ b79d5e1bad19a4dbf4f09c872d804ba927a8e3a5

envoy/config/rbac/v2alpha/rbac.proto

@@ -115,6 +115,11 @@ message Permission {
 
     // Metadata that describes additional information about the action.
     envoy.type.matcher.MetadataMatcher metadata = 7;
+
+    // Negates matching the provided permission. For instance, if the value of `not_rule` would
+    // match, this permission would not match. Conversely, if the value of `not_rule` would not
+    // match, this permission would match.
+    Permission not_rule = 8;
   }
 }
 
@@ -157,5 +162,10 @@ message Principal {
 
     // Metadata that describes additional information about the principal.
     envoy.type.matcher.MetadataMatcher metadata = 7;
+
+    // Negates matching the provided principal. For instance, if the value of `not_id` would match,
+    // this principal would not match. Conversely, if the value of `not_id` would not match, this
+    // principal would match.
+    Principal not_id = 8;
   }
 }