Backport of acls,catalog,mesh: properly authorize workload selectors on writes into release/1.17.x

[hc-github-team-consul-core]

Backport

This PR is auto-generated from #19260 to be assessed for backporting due to the inclusion of the label backport/1.17.

The below text is copied from the body of the original PR.

---

Description

To properly enforce writes on resources that have workload selectors with prefixes, we need another service authorization rule that allows us to check whether read is allowed within a given prefix. Specifically we need to only allow writes if the policy prefix allows for a wider set of names than the prefix selector on the resource. We should also not allow policies with exact names for prefix matches.

Part of NET-3993

Examples:
(when default is deny)

Decision: deny
selector:

Workloads: { Prefixes = ["api"] }

policy:

...
service "api" { policy = "read" }

Decision: allow
selector:

Workloads: { Prefixes = ["api"] }

policy:

...
service_prefix "api" { policy = "read" }

Decision: deny
selector:

Workloads: { Prefixes = ["api"] }

policy:

...
service_prefix "api1" { policy = "read" }

Testing & Reproduction steps

Links

PR Checklist

• updated test coverage
• external facing docs updated
• appropriate backport labels added
• [] not a security concern

---

Overview of commits

• 6350a81

[github-team-consul-core-pr-approver]

Auto approved Consul Bot automated PR