Add WASM plugin execution policy (skip_paths, skip_methods, fail_open)

[Shine-neko]

Summary

A WASM plugin that failed in its request phase returned a 502 for the request, so a failing plugin could take a site down. In production, the Umami analytics plugin also ran on every static asset — buffering a 1.4 MiB JS bundle up to the 1 MiB guest limit on each hit just to ignore it, and turning a collector hiccup into a page-wide 502 (console.kemeter.cloud assets).

This adds three operator-set fields to a plugin declaration in config.yaml that control when a plugin runs and how it fails. They are operator-controlled (never overridable per route).

Field	Default	Effect
skip_paths	[]	Request-path globs the plugin is skipped for (both phases) — no body buffering, no guest call. Keeps an analytics plugin off assets (*.js, *.css, /assets/*). * spans any characters including /; case-insensitive; query string ignored.
skip_methods	[]	HTTP methods the plugin is skipped for (e.g. OPTIONS, HEAD).
fail_open	true	On a guest error: true logs it and lets the request continue to the backend untouched — an observability plugin failing to reach its collector must never turn a page into a 502. Set false for a security plugin (WAF / bouncer) that must fail closed (returns 502).

What changed

• PluginConfig gains skip_paths, skip_methods, fail_open (default true).
• PluginPolicy + a tiny shell-style glob_match (no regex dep). WasmMiddleware carries the policy (shared across per-route derivations via Arc).
• on_request skips before any body buffering, and on a guest error honours fail_open (continue vs 502). on_response applies the same skip decision.
• RequestCtx now carries method / path so the response phase can make the same skip decision without holding the request.

Tests

• Unit: glob_match, path/method skipping, empty-policy, fail-open — 35 wasm tests green.
• e2e (12-wasm-plugin.sh): a *.js request bypasses the plugin (no x-wasm-plugin header) while / still carries it. Full suite: 121 passed, 0 failed.
• cargo fmt --check clean, clippy clean.
• Verified in production: console.kemeter.cloud back to 200 on the page and its assets, and the per-request buffering WARN on *.js is gone.

Docs

New "Execution policy" section in the WASM plugins docs, plus a CHANGELOG entry.