appsec: upgrade go-libddwaf/v3

[Hellzy]

What does this PR do?

JIRA: APPSEC-53057

Upgrades the go-libddwaf dependency to v3.
In v3, actions are now returned as a map[string]any mapping action types to their parameters.
Parameters, while technicaly described as a map[string]any, are actually map[string]string (i.e all param values are provided as strings).

Another important change is that actions are new more granular. When generating a block action, a GRPC and an HTTP
block action are now emitted, instead of a single monolithic block action.
Similarly, listeners can now listen for those actions individually.
This whole split removes a big layer of complexity.

Changes

• Split actions between http/grpc instead of bundling everything.
• Remove former action caching system which would embed actions in waf handles.
• Remove waf handle wrapping which is not necessary anymore
• Don't parse actions out of the ruleset, which is not necessary anymore since we don't cache them
• After a WAF run, we now:
  • parse actions returned through WAF results (new)
  • generate the actions (new)
  • propagate actions through dyngo and execute them

Motivation

Reviewer's Checklist

• Changed code has unit tests for its functionality at or near 100% coverage.
• System-Tests covering this feature have been added and enabled with the va.b.c-dev version tag.
• There is a benchmark for any new code, or changes to existing code.
• If this interacts with the agent in a new way, a system test has been added.
• Add an appropriate team label so this PR gets put in the right place for the release notes.
• Non-trivial go.mod changes, e.g. adding new modules, are reviewed by @DataDog/dd-trace-go-guild.

Unsure? Have a question? Request a review!

[pr-commenter]

Benchmarks

Benchmark execution time: 2024-05-21 14:10:46

Comparing candidate commit 5014170 in PR branch francois.mazeau/go-libddwaf-update with baseline commit d823db5 in branch main.

Found 0 performance improvements and 6 performance regressions! Performance is the same for 38 metrics, 0 unstable metrics.

scenario:BenchmarkPartialFlushing/Disabled-24

• 🟥 execution_time [+10.554ms; +13.609ms] or [+3.765%; +4.855%]

scenario:BenchmarkPartialFlushing/Enabled-24

• 🟥 execution_time [+9.236ms; +12.138ms] or [+3.335%; +4.383%]

scenario:BenchmarkSingleSpanRetention/no-rules-24

• 🟥 execution_time [+10.040µs; +10.704µs] or [+4.186%; +4.463%]

scenario:BenchmarkSingleSpanRetention/with-rules/match-all-24

• 🟥 execution_time [+9.195µs; +11.184µs] or [+3.789%; +4.608%]

scenario:BenchmarkSingleSpanRetention/with-rules/match-half-24

• 🟥 execution_time [+9.402µs; +11.052µs] or [+3.868%; +4.546%]

scenario:BenchmarkStartSpan-24

• 🟥 execution_time [+69.499ns; +117.101ns] or [+3.040%; +5.122%]