fix(ai-proxy): request identity encoding for translated streams

[benissimo]

Summary

Translated AI Proxy streaming paths can break when an upstream returns gzip-compressed SSE. This change requests Accept-Encoding: identity only when Kong is both:

• handling a streaming request, and
• not in preserve/pass-through mode.

Provider-specific Accept-Encoding behavior remains in place for non-streaming requests and preserve/pass-through streaming routes.

Why

Compressed SSE is safe when Kong can pass bytes through untouched. It is unsafe when Kong must parse and transform streaming frames because the parser needs raw SSE frames incrementally.

A concrete failure mode reproduced locally with an OpenAI-compatible upstream:

• request is streaming
• upstream returns gzip-compressed SSE
• Kong must translate the upstream stream to the client format
• downstream response is 200 + Content-Encoding: gzip + empty/unusable body

Requesting identity encoding for translated streams avoids negotiating gzip for the path that Kong must parse/transform.

Validation

Tested against a local kong/kong-gateway:3.14 Docker repro using the base ai-proxy plugin with an OpenAI-compatible upstream URL.

Before patch:

• non-streaming request: 200, JSON body
• streaming translated request: 200, Content-Type: text/event-stream, Content-Encoding: gzip, 0-byte body

After patch, overlaying the central normalize-request.lua change into the same container/config:

• non-streaming request: 200, JSON body
• streaming translated request: 200, Content-Type: text/event-stream, no Content-Encoding: gzip, readable SSE body

Example downstream SSE after patch:

event: message_start
data: {"type":"message_start",...}

event: content_block_delta
data: {"index":0,"delta":{"type":"text_delta","text":"Okay,"},...}

Tests

Updated streaming integration coverage to assert:

• translated OpenAI streaming upstream receives Accept-Encoding: identity
• native/preserve Bedrock streaming upstream keeps provider-specific Accept-Encoding: gzip, identity

I could not run the upstream bin/busted target in this local checkout because the Kong dev runtime is not installed (env: resty: No such file or directory). I did run git diff --check and validated the behavior in Docker as described above.

[CLAassistant]

All committers have signed the CLA.

[benissimo]

Bump, it's been 2 weeks, is anyone available to review this?

[benissimo]

@rolandatkong If you have a chance to review this, please let me know.