Issue Reserve/Commit wasm actions for TokenRateLimitPolicy

[eguzki]

Summary

Wasm-shim mechanics for the reservation flow: issue Reserve at the request phase, capture the reservation_id, and issue Commit at the response/stream-end phase (or immediately on the error path). Marked "TBD" in RFC 0021 — this issue covers the implementation design and build.

Design: RFC 0021, reference-level section "Expected work by component" (wasm-shim).

Depends on: Kuadrant/limitador#506 (Reserve/Commit RPCs).

Acceptance Criteria

• ServiceType gains RateLimitReserve / RateLimitCommit, additive to the existing enum (RateLimit | RateLimitCheck | RateLimitReport | Auth | Tracing | Dynamic); existing variants/handling in DynamicService/DynamicTask untouched
• reservation.amount / reservation.ttl evaluated via message_builder CEL on the Reserve action, same mechanism as hits_addend today
• reservation_id returned by Reserve captured via an on_reply → Store action into ReqRespCtx.stored_values, read back later in the same KuadrantFilter instance (no host export needed)
• On the error path (model call failure, timeout, non-2xx from model server): issue Commit immediately, typically with actual_amount: 0, instead of relying solely on TTL expiry (see RFC's Security considerations)
• Unit/integration tests covering: happy path (Reserve → Commit with actual usage), over-limit rejection at Reserve, and the error-path immediate-Commit behavior

Notes for reviewers

PR description should include: how to review (suggested order: ServiceType additions → CEL evaluation → stored_values plumbing → error-path Commit), and manual verification (local Envoy + wasm-shim, drive a request through a TokenRateLimitPolicy-protected route, observe Reserve/Commit calls e.g. via Limitador logs).

[adam-cattermole]

The ServiceType is in the process of being removed - Kuadrant/kuadrant-operator#2163

The majority of the changes will be on the operator side, with the exception of the new protobuf types which will need to be included in the wasm-shim the same as the existing ones - see here:

wasm-shim/crates/kuadrant-filter/src/filter/descriptor_manager.rs

Lines 392 to 395 in 3e9c5d2

	const RATELIMIT_DESCRIPTORS: &[u8] =
	include_bytes!(concat!(env!("OUT_DIR"), "/ratelimit_descriptors.bin"));
	const AUTH_DESCRIPTORS: &[u8] =
	include_bytes!(concat!(env!("OUT_DIR"), "/auth_descriptors.bin"));

wasm-shim/crates/kuadrant-filter/build.rs

Lines 78 to 113 in 3e9c5d2

	// Generate separate FileDescriptorSets for embedded services
	println!("Generating embedded descriptors...");
	// RateLimit service descriptors (both envoy and kuadrant services, same messages)
	let mut ratelimit_config = prost_build::Config::new();
	ratelimit_config.file_descriptor_set_path(format!("{}/ratelimit_descriptors.bin", out_dir));
	ratelimit_config.compile_protos(
	&[
	"../../vendor-protobufs/data-plane-api/envoy/service/ratelimit/v3/rls.proto",
	"../../vendor-protobufs/kuadrant/service/ratelimit/v1/ratelimit.proto",
	],
	&[
	"../../vendor-protobufs/data-plane-api/",
	"../../vendor-protobufs/protoc-gen-validate/",
	"../../vendor-protobufs/udpa/",
	"../../vendor-protobufs/xds/",
	"../../vendor-protobufs/googleapis/",
	"../../vendor-protobufs/kuadrant/",
	],
	)?;
	// Auth service descriptors (don't generate Rust code, just descriptor set)
	let mut auth_config = prost_build::Config::new();
	auth_config.file_descriptor_set_path(format!("{}/auth_descriptors.bin", out_dir));
	auth_config.compile_protos(
	&["../../vendor-protobufs/data-plane-api/envoy/service/auth/v3/external_auth.proto"],
	&[
	"../../vendor-protobufs/data-plane-api/",
	"../../vendor-protobufs/protoc-gen-validate/",
	"../../vendor-protobufs/udpa/",
	"../../vendor-protobufs/xds/",
	"../../vendor-protobufs/googleapis/",
	],
	)?;
	println!("Embedded descriptor generation completed!");