Egress pep

[aojea]

Fixes: #479

[gemini-code-assist]

Code Review

This pull request introduces support for egress destinations and HTTP narrowing within the SAM mesh. Egress destinations allow nodes to act as policy enforcement points for outbound HTTP calls to services outside the mesh, utilizing credentials stored locally on the serving nodes. HTTP narrowing enables restricting service grants to specific HTTP methods and paths. The changes span the API definitions, control plane distribution endpoints, node proxying and authorization logic, JS and Python SDKs, and documentation. During the review, an improvement opportunity was identified in internal/node/egress.go regarding the safe unwrapping of os.ReadFile errors to prevent formatting issues when errors.Unwrap returns nil.

[gemini-code-assist]

Using errors.Unwrap(err) directly inside fmt.Errorf with %w is risky because if err is not wrap-compatible (or if it is a custom error), errors.Unwrap will return nil. Passing nil to %w results in formatting issues like %!w(<nil>).\n\nTo safely strip the path from os.PathError while preserving the underlying error for errors.Is checks, use errors.As to extract the *os.PathError and wrap its Err field.

Suggested change

	data, err := os.ReadFile(filepath.Join(s.secretsDir, name))
	if err != nil {
	return "", fmt.Errorf("credential %q: %w (put the file in %s)", name, errors.Unwrap(err), s.secretsDir)
	}
	data, err := os.ReadFile(filepath.Join(s.secretsDir, name))
	if err != nil {
	var pathErr *os.PathError
	if errors.As(err, &pathErr) {
	return "", fmt.Errorf("credential %q: %w (put the file in %s)", name, pathErr.Err, s.secretsDir)
	}
	return "", fmt.Errorf("credential %q: %w (put the file in %s)", name, err, s.secretsDir)
	}