VAULT-3825: Wildcard ACL policies without a trailing slash should mat…

…ch LIST operations (#23874)

* allow lists to match without trailing slash

* changelog

changelog/23874.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+core: fix policies with wildcards not matching list operations due to the policy path not having a trailing slash 
+```

vault/acl.go

@@ -409,6 +409,16 @@ func (a *ACL) AllowOperation(ctx context.Context, req *logical.Request, capCheck
 		}
 	}
 
+	// List operations need to check without the trailing slash first, because
+	// there could be other rules with trailing wildcards that will match the
+	// path
+	if op == logical.ListOperation && strings.HasSuffix(path, "/") {
+		permissions = a.CheckAllowedFromNonExactPaths(strings.TrimSuffix(path, "/"), false)
+		if permissions != nil {
+			capabilities = permissions.CapabilitiesBitmap
+			goto CHECK
+		}
+	}
 	permissions = a.CheckAllowedFromNonExactPaths(path, false)
 	if permissions != nil {
 		capabilities = permissions.CapabilitiesBitmap