Roadrunner appsec support

[cataphract]

Description

• Adds AppSec support for RoadRunner.
• Adds integration tests to AppSec
• Adds (limited) ability to suppress function calls, to throw exceptions from advice, and to do recursive calls in advice.

Reviewer checklist

• Test coverage seems ok.
• Appropriate labels assigned.

Tickets

APPSEC-14734 APPSEC-12702 APPSEC-12703 APPSEC-12705

[bwoebi]

Ack for the uhook changes :-)

Maybe emit a LOG() line if suppressCall is attempted on an internal function, but that's it.

[Anilm3]

Still a lot to look through...

[estringana]

Not sure If I missed something but, when appsec is enabled dynamically by remote config, it status can change many times. So saying it does not have to be configure sounds confusing.

[cataphract]

"To be configured" means "yet to be configured" (=not configured yet") or "it is to be configured" (=it's arranged/programmed for it to be configured in the future"). The purpose of this setting is just to indicate in MINIT if we got a configuration setting for the state of remote config yet (if, for instance, we can't contact the daemon, then to_be_configured will stay with the value true). In this branch, appsec is explicitly enabled or disabled, so we're never waiting for a setting from remote config. Does this make sense? I also added some comments in bbdb003

[pr-commenter]

Benchmarks

Benchmark execution time: 2024-01-16 18:34:11

Comparing candidate commit 5fa4475 in PR branch glopes/roadrunner with baseline commit 32251e3 in branch master.

Found 2 performance improvements and 1 performance regressions! Performance is the same for 38 metrics, 49 unstable metrics.

scenario:HookBench/benchHookOverheadInstallHookOnFunction

• 🟥 execution_time [+24.981µs; +57.154µs] or [+3.289%; +7.525%]

scenario:PHPRedisBench/benchRedisBaseline

• 🟩 execution_time [-351.544µs; -184.114µs] or [-11.649%; -6.101%]

scenario:PHPRedisBench/benchRedisOverhead

• 🟩 execution_time [-404.658µs; -247.311µs] or [-12.636%; -7.722%]