feat(sdk): add L7 requests matcher for network policies

[QuiiBz]

This PR adds support for L7 requests matcher in network policies: for each NetworkPolicyRule, you can apply a matcher on:

• the request method
• the request path
• the request query strings
• the request headers

Each matcher can target to either exactly match, start with, or regex match, a provided value. For example, to inject an authorization header on requests to Vercel's AI gateway but only on specific requests:

allow: {
  "ai-gateway.vercel.sh": [
    {
      match: {
        method: ["POST"],
        path: { startsWith: "/v1/" },
        headers: [
          { key: { exact: "x-api-key" }, value: { exact: "placeholder" } }
        ]
      },
      transform: [{
        headers: { authorization: "Bearer ..." }
      }]
    }
  ],
  "*": []
}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
sandbox	Ready	Preview, Comment, Open in v0	Apr 30, 2026 1:14pm
sandbox-cli	Ready	Preview, Comment, Open in v0	Apr 30, 2026 1:14pm
sandbox-sdk	Ready	Preview, Comment, Open in v0	Apr 30, 2026 1:14pm
sandbox-sdk-ai-example	Ready	Preview, Comment, Open in v0	Apr 30, 2026 1:14pm
workflow-code-runner	Ready	Preview, Comment, Open in v0	Apr 30, 2026 1:14pm