Backport of [CC-5719] Add support for builtin global-read-only policy into release/1.14.x

[hc-github-team-consul-core]

Backport

This PR is auto-generated from #18319 to be assessed for backporting due to the inclusion of the label backport/1.14.

🚨

Warning automatic cherry-pick of commits failed. If the first commit failed,
you will see a blank no-op commit below. If at least one commit succeeded, you
will see the cherry-picked commits up to, not including, the commit where
the merge conflict occurred.

The person who merged in the original PR is:
@jjacobson93
This person should manually cherry-pick the original PR into a new backport PR,
and close this one when the manual backport PR is merged in.

merge conflict error: POST https://api.github.com/repos/hashicorp/consul/merges: 409 Merge conflict []

The below text is copied from the body of the original PR.

---

Description

This adds a new builtin policy that provides global read-only access, in contrast to the global read-write access that the builtin global-management policy provides. Other changes were made to process builtin policies more generically, since there are several places where checks or validations are done before processing or altering a policy.

Links

Ticket
RFC

PR Checklist

• updated test coverage
• external facing docs updated
• appropriate backport labels added
• not a security concern

---

Overview of commits

• 8244dc7 - 4a376a6 - 75552a9 - 209e57a - aad0946 - 96b0861 - 495162f - d54e3a9 - 9878915 - 7b5077d - 2a6a531 - d63fa54 - 3d099a6

[hashicorp-cla]

All committers have signed the CLA.

[github-team-consul-core-pr-approver]

Auto approved Consul Bot automated PR

[lornasong]

Resolved this by:

git remote update
git checkout -B backport/jer/read-only-policy/evenly-happy-doe origin/release/1.14.x
git cherry-pick 6424ef6a56435191aae5da1392ae2f5a89bc5591
git push -f origin backport/jer/read-only-policy/evenly-happy-doe

Commit cherry-picked: 6424ef6

Files that required resolving:

The conflicts seemed to be centered around that in 1.14:

• ACLTokenAnonymousID was in a different file
• ACLPolicy{} used to set Syntax to acl.SyntaxCurrent
• Some different variable names aclvs. aclEp in agent/consul/acl_endpoint_test.go

[lornasong]

A notable change is that I added Syntax: acl.SyntaxCurrent here. It is not in the original PR

[lornasong]

This Syntax is extra in 1.14. I didn't add it to writeBuiltinACLPolicy() because it's set here instead