OSSM-1955 Merge Envoy's 1.20 release branch

[oschaaf]

Merge branch release/v1.20 from envoyproxy/envoy.

This should resolve CI structurally failing as observed in recent pull requests,
by pulling in a change that updates expired certificates: bfb9b97

[oschaaf]

Annoyingly, the CI logs have:

[ RUN      ] TestSPIFFEValidator.TestDoVerifyCertChainIntermediateCerts
test/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator_test.cc:313: Failure
Value of: validator().doVerifyCertChain(store_ctx.get(), nullptr, *cert, nullptr)
  Actual: false
Expected: true
Stack trace:
  0x12c783a: Envoy::Extensions::TransportSockets::Tls::TestSPIFFEValidator_TestDoVerifyCertChainIntermediateCerts_Test::TestBody()
  0x33f1fbb: testing::internal::HandleSehExceptionsInMethodIfSupported<>()
  0x33e219d: testing::internal::HandleExceptionsInMethodIfSupported<>()
  0x33ca633: testing::Test::Run()
  0x33cb1fa: testing::TestInfo::Run()
... Google Test internal frames ...

[  FAILED  ] TestSPIFFEValidator.TestDoVerifyCertChainIntermediateCerts (130 ms)

git blame shows that we touched this test in 0150925 -- and indeed in that commit we modified certificate generation script to generate more certificates specifically for this test.

I'm going to the certificate regeneration script but commit just the four new files related the certs specific to this test. I suspect some inconsistency crept in as generating these may depend on the other certificates, and therefore the new ones need to be regenerated as well.

[oschaaf]

Ugh, the failure mode for TestSPIFFEValidator.TestDoVerifyCertChainIntermediateCerts was a bit more subtle then I initially thought. 082adf4 properly addresses it with minimal changes (confirmed locally).
Note: I force pushed to keep the list of commits clean.

[jwendell]

LGTM