ext_authz: support sending multiple headers with the same name to upstream (#11158)

This patch adds allowed_upstream_headers_to_append to allow sending multiple headers with the same name to upstream.

Relevant issue: solo-io/gloo#2983.

Risk Level: Low
Testing: Unit tests.
Docs Changes: Added.
Release Notes: Added.
Fixes #11156

Signed-off-by: weixiao-huang <hwx.simle@gmail.com>

Mirrored from https://github.com/envoyproxy/envoy @ dcf34972d1bc15324835c40dfd7a780e8fc69d72

envoy/extensions/filters/http/ext_authz/v3/ext_authz.proto

@@ -213,6 +213,11 @@ message AuthorizationResponse {
   // Note that coexistent headers will be overridden.
   type.matcher.v3.ListStringMatcher allowed_upstream_headers = 1;
 
+  // When this :ref:`list <envoy_api_msg_type.matcher.v3.ListStringMatcher>` is set, authorization
+  // response headers that have a correspondent match will be added to the client's response. Note
+  // that coexistent headers will be appended.
+  type.matcher.v3.ListStringMatcher allowed_upstream_headers_to_append = 3;
+
   // When this :ref:`list <envoy_api_msg_type.matcher.v3.ListStringMatcher>`. is set, authorization
   // response headers that have a correspondent match will be added to the client's response. Note
   // that when this list is *not* set, all the authorization response headers, except *Authority

envoy/extensions/filters/http/ext_authz/v4alpha/ext_authz.proto

@@ -213,6 +213,11 @@ message AuthorizationResponse {
   // Note that coexistent headers will be overridden.
   type.matcher.v4alpha.ListStringMatcher allowed_upstream_headers = 1;
 
+  // When this :ref:`list <envoy_api_msg_type.matcher.v4alpha.ListStringMatcher>` is set, authorization
+  // response headers that have a correspondent match will be added to the client's response. Note
+  // that coexistent headers will be appended.
+  type.matcher.v4alpha.ListStringMatcher allowed_upstream_headers_to_append = 3;
+
   // When this :ref:`list <envoy_api_msg_type.matcher.v4alpha.ListStringMatcher>`. is set, authorization
   // response headers that have a correspondent match will be added to the client's response. Note
   // that when this list is *not* set, all the authorization response headers, except *Authority