api-gateway: add node:read policy

[mikemorris]

To avoid silently filtering all nodes when ACLs are enabled and returning an empty set when attempting to map routes to Consul services registered in consul-k8s

Changes proposed in this PR:

• Add node_prefix "" { policy = "read" } to the API Gateway template for server-acl-init

How I've tested this PR:

• Manually applying this change fixed an error loop when deploying Consul API Gateway in GKE with ACLs enabled.

How I expect reviewers to test this PR:

• Deploy Consul API Gateway via the Helm chart with the following config set

global:
  gossipEncryption:
    autoGenerate: true 
  tls:
    enabled: true
    enableAutoEncrypt: true
  acls:
    manageSystemACLs: true

• Attempt to apply a route to the gateway - it should fail to attach before this fix, but succeed with this change.

Checklist:

• Tests added
• CHANGELOG entry added

[andrewstucki]

From the api gateway side of things, this LGTM, not sure if we want other k8s folks to sign off first though, also will need a Changelog entry.

[andrewstucki]

Just for posterity sake, this enables this particular api call. Without the ACL, the call returns an empty node set and the controller is unable to resolve any Consul services needed in an HTTPRoute configuration.

[nathancoleman]

I've requested review from @hashicorp/consul-eco-platform since that's who I was pointed to yesterday

[ndhanushkodi]

LGTM!