Build complex automatons more efficiently

[tvernum]

This change substantially reduces the CPU and Heap usage of
StringMatcher when processing large complex patterns.

The improvement is achieved by switching the order in which we
perform concatenation and union for common styles of wildcard patterns.

Given a set of wildcard strings:

• "*-logs-*"
• "*-metrics-*"
• "web-*-prod-*"
• "web-*-staging-*"

The old implementation would perform steps roughly like:

minimize {
    union {
        concatenate { MATCH_ANY, "-logs-", MATCH_ANY }
        concatenate { MATCH_ANY, "-metrics-", MATCH_ANY }
        concatenate { "web-", MATCH_ANY, "prod-", MATCH_ANY }
        concatenate { "web-", MATCH_ANY, "staging-", MATCH_ANY }
    }
}

The outer minimize would require determinizing the automaton, which
was highly inefficient

The new implementation is:

minimize {
    union {
        concatenate {
            MATCH_ANY ,
            minimize {
                union { "-logs-", "-metrics"- }
            }
            MATCH_ANY
        }
        concatenate {
            minimize {
                union {
                    concatenate { "web-", MATCH_ANY, "prod-" }
                    concatenate { "web-", MATCH_ANY, "staging-" }
                }
            }
            MATCH_ANY
        }
    }
}

By performing a union of the inner strings before concatenating the
MATCH_ANY ("*") the time & heap space spent on determinizing the
automaton is greatly reduced.

Resolves: #36062

[elasticmachine]

Pinging @elastic/es-security (Team:Security)

[tvernum]

To give an indication of the improvement...

If a user has this role:

{
    "indices": [
        {
            "names": [ "*-logs-*-prod-*", "*-logs-*-staging-*", "*-metrics-*-prod-*", "*-metrics-*-staging-*" ],
            "privileges": [ "read" ]
        },
        {
            "names": [ "*-logs-*-test-*", "*-logs-*-dev-*", "*-metrics-*-test-*", "*-metrics-*-dev-*" ],
            "privileges": [ "read" ]
        },
        {
            "names": [ "web-*-prod-*", "web-*-staging-*" ],
            "privileges": [ "read" ]
        },
        {
            "names": [ "web-*-test-*", "web-*-dev-*" ],
            "privileges": [ "read" ]
        },
        {
            "names": [ "*-host-zeus-*", "*-host-hermes-*", "*-host-hera-*", "*-host-ares-*", "*-host-orion-*", "*-host-atlas-*", "*-host-apollo-*" ],
            "privileges": [ "read" ]
        }
    ]
}

Then in current versions (7.11 snapshot), even with max_determinized_states set to 1,000,000 the user will not be able to search any indices, because determinizing the automaton will take about 6 seconds, and then fail with:

Determinizing automaton with 284 states and 356 transitions would result in more than 1000000 states.

After this PR, that role will work correctly, using the defaults (max_determinized_states: 100,000) and determinizes in < 100 milliseconds

[ywangd]

LGTM with a few minor comments.

The efficiency improvement is outstanding. Great job!

[ywangd]

Shoud we guard these with a check for p.length() == 0?

[ywangd]

It is possible that the pattern is **. As such the infix is an empty string and can be skipped. But as discussed, it is probably better handled as part of compacting all consecutive *, which can be done in a separate PR.

[ywangd]

I think the pattern like something* should also reach here and should be part of the comment.

[ywangd]

This sentence reads weird to me. Should it be something like ... (one for the union of strings, and another one after ...)

[ywangd]

Nit: I'd prefer to name this variable with a noun, something like buildFunc.

[BigPandaToo]

I am with Yang on comment on the line 122 ^^
Otherwise LGTM