fix(envoyconfig): use DNS SAN type in MatchTypedSubjectAltNames

Replace deprecated MatchSubjectAltNames with MatchTypedSubjectAltNames.
Diego container identity certs use DNSNames (container GUID + internal
routes), so hardcode SanType=DNS. Update tests to match.

Author: ameowlia

src/code.cloudfoundry.org/executor/depot/containerstore/proxy_config_handler_test.go

@@ -651,8 +651,8 @@ var _ = Describe("ProxyConfigHandler", func() {
 							},
 						},
 						MatchTypedSubjectAltNames: []*envoy_tls.SubjectAltNameMatcher{
-							{SanType: envoy_tls.SubjectAltNameMatcher_URI, Matcher: &envoy_matcher.StringMatcher{MatchPattern: &envoy_matcher.StringMatcher_Exact{Exact: "valid-alt-name-1"}}},
-							{SanType: envoy_tls.SubjectAltNameMatcher_URI, Matcher: &envoy_matcher.StringMatcher{MatchPattern: &envoy_matcher.StringMatcher_Exact{Exact: "valid-alt-name-2"}}},
+							{SanType: envoy_tls.SubjectAltNameMatcher_DNS, Matcher: &envoy_matcher.StringMatcher{MatchPattern: &envoy_matcher.StringMatcher_Exact{Exact: "valid-alt-name-1"}}},
+							{SanType: envoy_tls.SubjectAltNameMatcher_DNS, Matcher: &envoy_matcher.StringMatcher{MatchPattern: &envoy_matcher.StringMatcher_Exact{Exact: "valid-alt-name-2"}}},
 						},
 					},
 				}))

src/code.cloudfoundry.org/executor/envoyconfig/config.go

@@ -423,7 +423,7 @@ func generateSDSCAResourceSecret(container executor.Container, idCred Credential
 	var matchers []*envoy_tls.SubjectAltNameMatcher
 	for _, s := range subjectAltNames {
 		matchers = append(matchers, &envoy_tls.SubjectAltNameMatcher{
-			SanType: envoy_tls.SubjectAltNameMatcher_URI,
+			SanType: envoy_tls.SubjectAltNameMatcher_DNS,
 			Matcher: &envoy_matcher.StringMatcher{MatchPattern: &envoy_matcher.StringMatcher_Exact{Exact: s}},
 		})
 	}

src/code.cloudfoundry.org/executor/envoyconfig/config_test.go

@@ -134,13 +134,19 @@ func TestGenerateSDSCAResource(t *testing.T) {
 	container := executor.Container{Guid: "meow-guid"}
 	idCred := Credential{}
 	trusted := []string{}
-	yaml, err := GenerateSDSCAResource(container, idCred, trusted, []string{"spiffe://meow"})
+	yaml, err := GenerateSDSCAResource(container, idCred, trusted, []string{"some-guid.cf.internal", "gorouter.service.cf.internal"})
 	if err != nil {
 		t.Fatal(err)
 	}
 	if !bytes.Contains(yaml, []byte("id-validation-context")) {
 		t.Error("YAML missing validation context name")
 	}
+	if !bytes.Contains(yaml, []byte("some-guid.cf.internal")) {
+		t.Error("YAML missing first DNS SAN")
+	}
+	if !bytes.Contains(yaml, []byte("gorouter.service.cf.internal")) {
+		t.Error("YAML missing second DNS SAN")
+	}
 }
 
 func TestGenerateSDSCAResource_TrustedCACertsTooLarge(t *testing.T) {