Add suffix for oauth cookies

[zhaohuabing]

This PR adds a suffix for oauth cookies to prevent multiple oauth filters from overwriting each other's cookies.

The suffix is the hashed UID of the SecurityPolicy that contains the OIDC configuration.

For example:

                  bearerToken: BearerToken-5F93C2E4
                  idToken: IdToken-5F93C2E4
                  oauthExpires: OauthExpires-5F93C2E4
                  oauthHmac: OauthHMAC-5F93C2E4
                  refreshToken: RefreshToken-5F93C2E4

[codecov]

Codecov Report

Attention: 3 lines in your changes are missing coverage. Please review.

Comparison is base (7ab3da6) 63.36% compared to head (822d5dd) 63.37%.
Report is 1 commits behind head on main.

Files	Patch %	Lines
internal/gatewayapi/securitypolicy.go	57.14%	2 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2664      +/-   ##
==========================================
+ Coverage   63.36%   63.37%   +0.01%     
==========================================
  Files         119      119              
  Lines       19098    19112      +14     
==========================================
+ Hits        12102    12113      +11     
- Misses       6196     6198       +2     
- Partials      800      801       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[arkodg]

can we reuse

gateway/internal/provider/utils/utils.go

Line 39 in 4c79ef9

func HashString(str string) string {

?

[liorokman]

HashString uses SHA256, which is theoretically slower than FNV-32, and generates a 256-bit result.

I don't think it matters that much for this purpose that the hash being used is slower, or crypto-secure, but using the full 256 bits in the cookie suffix would result in 64 characters instead of the current 8. I think that would be a little long for a cookie name.

Using only 32 bit from the result would theoretically be OK for this purpose, but I would prefer to use the FNV-32 hash function here so that the entire hash result would still be used.

[zhaohuabing]

It's just 5 lines and I don't like importing provider/utils package in gateway :-)
WDYT?

[zirain]

move it into a more common package, e.g. internal/util

[arkodg]

non blocking comment - less code, lesser bugs, lesser vulnerabilities, if this hash function is better, lets replace it with the one in provider/utils, as @zirain suggests, if provider/utils is the wrong home, lets move it to utils

[zhaohuabing]

Will do in a follow-up PR because changing the location of the provider/utils impacts many places.

[zhaohuabing]

#2681

[liorokman]

LGTM