xds/rbac: lowercase header matcher names before matching (#9332)

The RBAC filter passes the name of a header matcher to the matching
engine unchanged. The metadata that the engine matches against always
has lowercase keys. A name that contains an uppercase character
therefore matches no header, and the rule that holds it never fires. The
policy parses, reports no error and looks active. A DENY policy written
this way fails open.

The A41 validation reads the same unnormalized name, so the rejection of
:scheme and grpc- prefixed matchers misses the name Grpc-Status. A Host
matcher also keeps its name, although A41 makes host and :authority
equivalent.

Lowercase the name in normalizeHeaderMatcher. That function already owns
the A41 rules and already rewrites the name in place, so the matching
engine, the :scheme and grpc- rejection, and the host alias all read one
normalized name. Envoy holds each header matcher name in a
LowerCaseString, grpc-java lowercases the name before it looks the
header up, and authz/rbac_translator.go lowercases the name on the
non-xDS path.

The new test in test/xds shows the effect on an end user. A DENY policy
on the header name User-Agent returns OK for every RPC before the change
and PermissionDenied after it. The unit tests cover the name that the
parse gives to the engine, the case of the :scheme and grpc- rejection,
and the host alias, at the top level and inside a nested rule.

RELEASE NOTES:

- xds/rbac: Fix a bug where a header matcher whose name was not
lowercase, such as `X-Role`, matched no header, which could cause DENY
rules to fail open.
- xds/rbac: Fix a bug where a `:scheme` or `grpc-` prefixed header
matcher was accepted when its name was not lowercase.
- xds/rbac: Fix a bug where a `Host` header matcher was not replaced
with `:authority`.

Co-authored-by: Markus Magnuson <331091+alimony@users.noreply.github.com>