Policy auth precedence fix

[jrajahalme]

Note for review: This is blocked by #26344 and needs to be rebased after it merges. First two commits are from this.

Explicitly specified authentication mode should apply to all traffic that matches the given policy map key. For example, if an L3-only policy specified that authentication is required, then it should be required also on all L3/L4-policies on the same L3, even if not specified in the L3/L4-policy. Similarly, an L3-only auth policy should apply to to all ports on the given L3, even if there is an L4-only policy that has no authentication requirement. In the most general case, an Allow-all policy with authentication requirement should apply to all traffic, unless authentication is explicitly disabled for specific L3, L4, or both.

To achieve this, we must scan all the policy map keys, when adding a new entry, as the new entry's auth type may have to be overridden by the explicit auth type of a more general entry, or the auth type of more specific entries may have to be updated due to the explicit auth type on the new entry. This is somewhat similar to how deny rules take precedence over more specific entries.

To limit the additional computational cost of this map scanning, we track the use of authentication (and deny rules) on the ingress/egress policy level, and skip the scanning that is not necessary when the policy does not contain any authentication (or deny) rules.

The commit to merge DerivedFromRules (from PR #26346) is included here to allow for the unit tests in the last commit to reliably track the DerivedFromRules labels of the entries added by toMapState().

[jrajahalme]

/test

[jrajahalme]

/test

[jrajahalme]

/test

[jrajahalme]

/test

[jrajahalme]

/test

[jrajahalme]

/test

[jrajahalme]

/test