ci: fix Envoy int test versions

Follow-up to #20956

Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>

backport of commit fdf3f9b2



Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>

Backport of security: bump go, x/net and envoy versions into release/1.15.x

* Bump go version

* Bump x/net

* Bump envoy version

* Add changelog

---------

Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>

Update Dockerfile

* Update Dockerfile

* Update Dockerfile

* Create 20897.txt

backport of commit c8d6b2528cdf861bff796d6d8e5a93e7e4c660b7

Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>

* backport of commit d65cacc7

* backport of commit 60ab1568



---------

Co-authored-by: dduzgun-security <deniz.duzgun@hashicorp.com>
Co-authored-by: Chris S. Kim <ckim@hashicorp.com>

backport of commit c1e25c56



Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com>

Backport of [NET-8367] security: upgrade google.golang.org/protobuf to 1.33.0 into release/1.15.x (#20803)

* backport of commit a4076167

* backport of commit 455f67fa



---------

Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>

Manual backport of [NET-6741] make: Add target for updating dependencies across all modules into release/1.15.x (#20687)

* backport of commit 6f0e24cd

* partial backport of commit 77f44fa8

Update go-mod-tidy Make target to use flexible modules list.

This will update the list to include envoyextensions and troubleshoot.

* backport of commit 94a0aa2e

* backport of commit f0e1badd

* backport of commit 183dd2fb



---------

Co-authored-by: Sarah Alsmiller <sarah.alsmiller@hashicorp.com>

update changelog 1.15.x

backport of commit ded3c9fa



Co-authored-by: Luke Kysow <1034429+lkysow@users.noreply.github.com>

security: Bump Envoy versions to address CVEs

* backport of commit 6c31fd76

* backport of commit 8620e735



---------

Co-authored-by: skpratt <sarah.pratt@hashicorp.com>

* backport of commit 1668a314

* backport of commit d33eda97



* Backport DeliverLatest func.

---------

Co-authored-by: Derek Menteer <derek.menteer@hashicorp.com>

* no-op commit due to failed cherry-picking

* Fix audit-log encoding issue (CC-7337) (#20345)

* add changes

* added changelog

* change update

* CE chnages

* Removed gzip size fix

* fix changelog

* Update .changelog/20345.txt

Co-authored-by: Hans Hasselberg <hans@hashicorp.com>

* Adding comments

---------

Co-authored-by: Abhishek Sahu <abhishek.sahu@hashicorp.com>
Co-authored-by: Hans Hasselberg <hans@hashicorp.com>
Co-authored-by: srahul3 <rahulsharma@hashicorp.com>

---------

Co-authored-by: temp <temp@hashicorp.com>
Co-authored-by: Ashesh Vidyut <134911583+absolutelightning@users.noreply.github.com>
Co-authored-by: Abhishek Sahu <abhishek.sahu@hashicorp.com>
Co-authored-by: Hans Hasselberg <hans@hashicorp.com>
Co-authored-by: srahul3 <rahulsharma@hashicorp.com>

Fix issue with persisting proxy-defaults

This resolves an issue introduced in hashicorp/consul#19829
where the proxy-defaults configuration entry with an HTTP protocol
cannot be updated after it has been persisted once and a router
exists. This occurs because the protocol field is not properly
pre-computed before being passed into validation functions.

Co-authored-by: Derek Menteer <derek.menteer@hashicorp.com>

This replicates the pattern used in `main` and `release/1.17.x`.

* backport of commit 3885ff70

* backport of commit 97501c91

* backport of commit 5330e755

* backport of commit 1ff82ed2



---------

Co-authored-by: natemollica-dev <57850649+natemollica-nm@users.noreply.github.com>
Co-authored-by: natemollica-dev <nathan.mollica@hashicorp.com>

backport of commit d5005719



Co-authored-by: Blake Covarrubias <blake@covarrubi.as>

Disable Envoy version check.

The current version of this script does not work well with the LTS release having a much
longer list of supported Envoy versions than the other branches. Later on, we should
tweak this to have the expected behavior, but for now, it is being disabled so that the
CICD pipeline can complete successfully and publish images.

Fix CICD script that checks envoy versions.

LTS supports more than 4 envoy versions, so the script was failing.

Use mirrored image for CICD tests.

Co-authored-by: Derek Menteer <derek.menteer@hashicorp.com>

Fix CICD docker image rate limits.

The docker image used in CICD was referencing `registry.k8s.io/pause:3.3`,
which appears to no longer function correctly. This commit swaps over to a
Hashicorp mirrored image that shouldn't have rate limits or disappearing
images.

Co-authored-by: Derek Menteer <derek.menteer@hashicorp.com>

* LTS - Add envoy support for 1.26, 1.27 and 1.28

* update version to 1.15.10-dev

* update changelog

backport of commit fd527e7e



Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>

security: update gopkg.in/yaml

This addresses CVE-2022-28948 and CVE-2021-4235.

Backport of security: disable Vault secret scans due to false positives into release/1.15.x (#20272)

backport of commit 20ee3373



Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>

Backport of Fix to not create a watch to `Internal.ServiceDump` when mesh gateway is not used into release/1.15.x (#20266)

This add a fix to properly verify the gateway mode before creating a watch specific to mesh gateways. This watch have a high performance cost and when mesh gateways are not used is not used.

This also adds an optimization to only return the nodes when watching the Internal.ServiceDump RPC to avoid unnecessary disco chain compilation. As watches in proxy config only need the nodes.

* backport of commit b0ce20b5
* backport of commit 3d4bde00
* backport of commit b2c77246
* backport of commit e7ab4d41
* backport of commit d00d9c5d
* backport of commit b2db3d5e
* backport of commit 50fb45ac
* backport of commit 7b41a61c
* backport of commit 2fa0e0a6
* backport of commit 88849c90
* backport of commit 4ac54f10
* backport of commit 2a9dfc37


* Fix tests for backport.

---------

Co-authored-by: Dhia Ayachi <dhia@hashicorp.com>
Co-authored-by: Derek Menteer <derek.menteer@hashicorp.com>

Backport of check error in TestDNSCycleRecursorCheckAllFail before asserting response to stop panic in CI. into release/1.15.x (#20233)

check error in TestDNSCycleRecursorCheckAllFail before asserting response to stop panic in CI. (#20231)

Co-authored-by: John Murret <john.murret@hashicorp.com>

docs: Remove ACLs section from k8s cluster peering page (#20176)

* Remove ACLs section

* Tech specs removal

backport of commit 9816a74b



Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>