connect: strip port from DNS SANs for ingress gateway leaf cert

[kyhavlov]

Closes #11092 - currently we're passing along whatever's in the Hosts field verbatim to construct the list of SANs. This PR changes that to strip the : and everything after it from each Host string so that it's in the format Vault expects when signing the leaf cert.

[jkirschner-hashicorp]

@kyhavlov : Thanks! A few follow-up questions:

• Which versions do we intend to attempt to backport this to?
• Should we intervene where you did (at the ingress gateway point)? Or is there any reason to strip host out from dnsnames at a more general point (like in the CSR code)?
• Do we need any automated tests for this? (Since there are no unit tests, I assume we manually tested instead?)

[kyhavlov]

@jkirschner-hashicorp

• Probably through 1.12
• Agreed that it makes more sense in the connect package - I was looking at alternate places it could go and moved it there
• Added a test in the connect package for it (easier to unit test it there too)

[jkirschner-hashicorp]

@kyhavlov: I think I spotted something that can quickly be fixed.

[jkirschner-hashicorp]

Should we confirm that len(hostSegments) > 0 here before accessing the 0th element, to ensure we don't have an out-of-bounds access?

[jkirschner-hashicorp]

To test this edge case, I guess you could add a host "" to the array in your test

[pglass]

This should be okay. strings.Split only returns an empty list when both arguments are empty.

formattedHost could be empty here, but that would only occur if the one of dnsNames had no hostname, like :8080.

[jkirschner-hashicorp]

We wouldn't want a bad configuration (like ":8080") to cause a panic though, right?

[jkirschner-hashicorp]

This check seems to be ineffective in its current position, because we're already assuming that hostSegments has at least 1 element by accessing its 0th element without a guard.

[pglass]

This should be okay. strings.Split only returns an empty list when both arguments are empty.

formattedHost could be empty here, but that would only occur if the one of dnsNames had no hostname, like :8080.

[jkirschner-hashicorp]

LGTM!