Backport of Fix up case where subscription is terminated due to ACLs changing or a snapshot restore occurring into release/1.15.x

[hc-github-team-consul-core]

Backport

This PR is auto-generated from #17566 to be assessed for backporting due to the inclusion of the label backport/1.15.

The below text is copied from the body of the original PR.

---

Description

Due to swallowing and only logging xDS errors here:

consul/agent/proxycfg/state.go

Lines 375 to 386 in 88951bf

	if IsTerminalError(u.Err) {
	s.logger.Error("Data source in an irrecoverable state; exiting", "error", u.Err, "correlationID", u.CorrelationID)
	s.Close(true)
	return
	}
	if err := s.handler.handleUpdate(ctx, u, snap); err != nil {
	s.logger.Error("Failed to handle update from watch",
	"id", u.CorrelationID, "error", err,
	)
	continue
	}

We were getting into a state where if ACLs were modified while connected to xDS, the stream wasn't properly being re-established and instead the Consul logs were filling up with error logs such as:

Failed to handle update from watch: kind=api-gateway proxy=default/default/gateway-d6b4d69c-krz5b service_id=default/default/gateway-d6b4d69c-krz5b id=gateway-config error="error filling agent cache: subscription closed by server, client must reset state and resubscribe"

Basically we were missing some casing for marking certain errors as TerminalErrors in proxycfg-glue, this fixes that.

Testing & Reproduction steps

Get a proxy and/or gateway to connect up to xDS and then modify the token ACLs that are associated with it, you should see a bunch of these in the logs.

PR Checklist

• updated test coverage
• external facing docs updated
• appropriate backport labels added
• not a security concern

---

Overview of commits

• 82e7d4f - 45008e2 - bdee9e3

[github-team-consul-core-pr-approver]

Auto approved Consul Bot automated PR