xds/rbac: replace legacy net to netip (#8908)

Updates #8884 

this PR replace net.IPNet with netip.Prefix in file
`internal/xds/rbac/matchers.go`.
- Replaced internal matcher CIDR type from `*net.IPNet` to
`netip.Prefix`
- Migrated CIDR parsing from `net.ParseCIDR` to `netip.ParsePrefix`,
with .Masked() normalization to keep canonical network behavior


RELEASE NOTES: N/A

Author: hugehoo

internal/xds/rbac/matchers.go

@@ -19,7 +19,6 @@ package rbac
 import (
 	"errors"
 	"fmt"
-	"net"
 	"net/netip"
 	"regexp"
 
@@ -330,41 +329,41 @@ func (upm *urlPathMatcher) match(data *rpcData) bool {
 type remoteIPMatcher struct {
 	// ipNet represents the CidrRange that this matcher was configured with.
 	// This is what will remote and destination IP's will be matched against.
-	ipNet *net.IPNet
+	ipNet netip.Prefix
 }
 
 func newRemoteIPMatcher(cidrRange *v3corepb.CidrRange) (*remoteIPMatcher, error) {
 	// Convert configuration to a cidrRangeString, as Go standard library has
 	// methods that parse cidr string.
 	cidrRangeString := fmt.Sprintf("%s/%d", cidrRange.AddressPrefix, cidrRange.PrefixLen.Value)
-	_, ipNet, err := net.ParseCIDR(cidrRangeString)
+	ipNet, err := netip.ParsePrefix(cidrRangeString)
 	if err != nil {
 		return nil, err
 	}
-	return &remoteIPMatcher{ipNet: ipNet}, nil
+	return &remoteIPMatcher{ipNet: ipNet.Masked()}, nil
 }
 
 func (sim *remoteIPMatcher) match(data *rpcData) bool {
 	ip, _ := netip.ParseAddr(data.peerInfo.Addr.String())
-	return sim.ipNet.Contains(net.IP(ip.AsSlice()))
+	return sim.ipNet.Contains(ip)
 }
 
 type localIPMatcher struct {
-	ipNet *net.IPNet
+	ipNet netip.Prefix
 }
 
 func newLocalIPMatcher(cidrRange *v3corepb.CidrRange) (*localIPMatcher, error) {
 	cidrRangeString := fmt.Sprintf("%s/%d", cidrRange.AddressPrefix, cidrRange.PrefixLen.Value)
-	_, ipNet, err := net.ParseCIDR(cidrRangeString)
+	ipNet, err := netip.ParsePrefix(cidrRangeString)
 	if err != nil {
 		return nil, err
 	}
-	return &localIPMatcher{ipNet: ipNet}, nil
+	return &localIPMatcher{ipNet: ipNet.Masked()}, nil
 }
 
 func (dim *localIPMatcher) match(data *rpcData) bool {
 	ip, _ := netip.ParseAddr(data.localAddr.String())
-	return dim.ipNet.Contains(net.IP(ip.AsSlice()))
+	return dim.ipNet.Contains(ip)
 }
 
 // portMatcher matches on whether the destination port of the RPC matches the