formatter: add sha256 request header substitution formatter

[cooper-oai]

Commit Message: formatter: add sha256 request header substitution formatter

Additional Description:

Add %REQUEST_HEADER_SHA256(X?Y)% and %REQ_SHA256(X?Y)% as built-in HTTP substitution formatters. Both return the lowercase SHA-256 digest of request header X, falling back to Y when X is missing or empty. Missing and empty values produce no output rather than hashing an empty string.

This supports request correlation and consistent hashing for internal gRPC calls such as ext_authz without copying plaintext sensitive header values into gRPC metadata. Header names are parsed at configuration time, and the implementation reuses Envoy's existing crypto utility.

Risk Level: Low. This is an optional, additive formatter and does not change existing formatters, routing, or xDS APIs.

Testing:

• bazel test --config=clang --jobs=8 --local_ram_resources=12288 //test/common/formatter:substitution_formatter_test --test_output=errors
• Envoy's tools/local_fix_format.sh formatting and spelling checks on all changed files.

Docs Changes: Document both operators, empty-header fallback, and the limits of unkeyed SHA-256 in the substitution formatter reference.

Release Notes: Added a new-feature release note for the SHA-256 request-header formatters.

Platform Specific Features: N/A

AI assistance: The implementation, tests, and documentation were prepared with AI assistance and reviewed by the submitter.

Related to #9652.

Fixes #46890

[repokitteh-read-only]

Hi @cooper-oai, welcome and thank you for your contribution.

We will try to review your Pull Request as quickly as possible.

In the meantime, please take a look at the contribution guidelines if you have not done so already.

🐱

Caused by: #46891 was opened by cooper-oai.

see: more, trace.