[confignet] Allow setting security descriptors for npipes

[swiatekm]

Description

Add dialer.security_descriptor field to set an SDDL security descriptor on Windows named pipe (npipe) listeners in confignet.

Link to tracking issue

Fixes #15211

Testing

Added unit tests which actually create the named pipe with specified descriptors.

Documentation

Documented the field in the struct definition, the schema, and the readme.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.03%. Comparing base (52e6bf4) to head (7dc37bb).

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #15212   +/-   ##
=======================================
  Coverage   91.03%   91.03%           
=======================================
  Files         729      729           
  Lines       48491    48499    +8     
=======================================
+ Hits        44144    44152    +8     
  Misses       3020     3020           
  Partials     1327     1327           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

This PR was marked stale due to lack of activity. It will be closed in 14 days.

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: swiatekm / name: Mikołaj Świątek (36be695, aad6cd5, b95b422)

[github-actions]

This PR was marked stale due to lack of activity. It will be closed in 14 days.

[github-actions]

Closed as inactive. Feel free to reopen if this PR is still being worked on.

[codspeed-hq]

Merging this PR will not alter performance

⚠️ Unknown Walltime execution environment detected

Using the Walltime instrument on standard Hosted Runners will lead to inconsistent data.

For the most accurate results, we recommend using CodSpeed Macro Runners: bare-metal machines fine-tuned for performance measurement consistency.

✅ 3 untouched benchmarks
🗄️ 2 archived benchmarks run¹

---

_{Comparing swiatekm:feat/confignet-npipe-security-descriptor (7dc37bb) with main (52e6bf4)}

Footnotes

1. 2 benchmarks were run, but are now archived. If they were deleted in another branch, consider rebasing to remove them from the report. Instead if they were added back, click here to restore them. ↩

[callegarimattia]

First time reviewing here, so bear with me. I went through the confignet npipe changes and have a couple of suggestions below, feel free to discard if you've already considered them.

[callegarimattia]

winio.ListenPipe already normalises a nil config to &PipeConfig{} internally (pipe.go:515), so the nil-guard branch isn't needed. Passing &winio.PipeConfig{SecurityDescriptor: securityDescriptor} directly is equivalent.

If a second field is added to NpipeConfig, the guard would silently drop it when securityDescriptor is empty.

[swiatekm]

Good catch, simplified this down to a single line.

[callegarimattia]

Should the security descriptor be part of the validation? Right now, if the SDDL is invalid, it fails when Listen is called, but it could be caught here beforehand. go-winio already exposes a conversion method that could be used to validate. It's the same one used in the Listen flow.

[swiatekm]

Added the validation.