consul: update to 1.16.1

SECURITY:

* Update golang.org/x/net to v0.13.0 to address CVE-2023-3978.
* Upgrade golang.org/x/net to address CVE-2023-29406
* Upgrade to use Go 1.20.6. This resolves CVE-2023-29406(net/http) for uses
  of the standard library. A separate change updates dependencies on
  golang.org/x/net to use 0.12.0.
* Upgrade to use Go 1.20.7. This resolves vulnerability
  CVE-2023-29409(crypto/tls).

FEATURES:

* cli: consul members command uses -filter expression to filter members
  based on bexpr.
* cli: consul operator raft list-peers command shows the number of commits
  each follower is trailing the leader by to aid in troubleshooting.
* cli: consul watch command uses -filter expression to filter response from
  checks, services, nodes, and service.
* reloadable config: Made enable_debug config reloadable and enable pprof
  command to work when config toggles to true
* ui: consul version is displayed in nodes list with filtering and sorting
  based on versions

IMPROVEMENTS:

* Fix some typos in metrics docs
* acl: added builtin ACL policy that provides global read-only
  access (builtin/global-read-only)
* acl: allow for a single slash character in policy names
* connect: Add capture group labels from Envoy cluster FQDNs to Envoy
  exported metric labels
* connect: Improve transparent proxy support for virtual services and
  failovers.
* connect: update supported envoy versions to 1.23.12, 1.24.10, 1.25.9,
  1.26.4
* debug: change default setting of consul debug command. now default
  duration is 5ms and default log level is 'TRACE'
* extensions: Improve validation and error feedback for property-override
  builtin Envoy extension
* hcp: Add dynamic configuration support for the export of server metrics
  to HCP.
* hcp: Removes requirement for HCP to provide a management token
* http: GET API operator/usage endpoint now returns node count cli: consul
  operator usage command now returns node count
* mesh: Expose remote jwks cluster configuration through jwt-provider
  config entry
* mesh: Stop jwt providers referenced by intentions from being deleted.
* ui: the topology view now properly displays services with mixed connect
  and non-connect instances.
* xds: Explicitly enable WebSocket connection upgrades in HTTP connection
  manager

BUG FIXES:

* Fix a bug that wrongly trims domains when there is an overlap with DC
  name.
* api-gateway: fix race condition in proxy config generation when Consul is
  notified of the bound-api-gateway config entry before it is notified of
  the api-gateway config entry.
* api: Fix client deserialization errors by marking new Enterprise-only
  prepared query fields as omit empty
* ca: Fixes a Vault CA provider bug where updating RootPKIPath but not
  IntermediatePKIPath would not renew leaf signing certificates
* connect/ca: Fixes a bug preventing CA configuration updates in secondary
  datacenters
* connect: (Enterprise only) Fix bug where intentions referencing sameness
  groups would not always apply to members properly.
* connect: Fix incorrect protocol config merging for transparent proxy
  implicit upstreams.
* connect: Removes the default health check from the consul connect envoy
  command when starting an API Gateway. This health check would always fail.
* connect: fix a bug with Envoy potentially starting with incomplete
  configuration by not waiting enough for initial xDS configuration.
* gateway: Fixes a bug where envoy would silently reject RSA keys that are
  smaller than 2048 bits, we now reject those earlier in the process when we
  validate the certificate.
* http: fixed API endpoint PUT /acl/token/:AccessorID (update token), no
  longer requires AccessorID in the request body. Web UI can now update
  tokens.
* mesh: (Enterprise Only) Require that jwt-provider config entries are
  created in the default namespace.
* snapshot: fix access denied and handle is invalid when we call snapshot
  save on windows - skip sync() for folders in windows in rboyer/safeio#3
* xds: Prevent partial application of non-Required Envoy extensions in the
  case of failure.

consul/Makefile

@@ -1,6 +1,6 @@
 # $NetBSD$
 
-DISTNAME=	consul-1.16.0
+DISTNAME=	consul-1.16.1
 CATEGORIES=	sysutils
 MASTER_SITES=	${MASTER_SITE_GITHUB:=hashicorp/}