apis: support TRACE_ID and SPAN_ID access log operators

[AkashKumar7902]

Fixes #7550

What this PR does

• adds Envoy's TRACE_ID and SPAN_ID operators to Contour's simple access-log operator allowlist
• supports the trace_id and span_id JSON short forms
• verifies the generated JSON access-log mappings
• leaves the default access-log fields unchanged

Why

Contour currently rejects these operators during access-log validation even though the shipped Envoy 1.38 release supports both. The operators were missing from Contour's known simple-operator list.

Impact

Users can opt in to logging active trace and span identifiers and correlate Envoy access-log entries with their distributed tracing backend.

Testing

• focused and race tests for ./apis/projectcontour/v1alpha1 and ./internal/envoy/v3
• full uncached Go test suite with the project's build tags
• full go vet with the project's build tags
• make lint-codespell and make lint-flags
• gofumpt on the changed Go files and git diff --check

Release note

Requested label: release-note/small. The corresponding numbered changelog is included.

[AkashKumar7902]

Could a maintainer please apply the release-note/small label? I do not have permission to label the upstream PR. The matching numbered changelog is already included.

[github-actions]

The Contour project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

• After 30d of inactivity, lifecycle/stale is applied
• After 60d of inactivity since lifecycle/stale was applied, the PR is closed

You can:

• Ensure your PR is passing all CI checks. PRs that are fully green are more likely to be reviewed. If you are having trouble with CI checks, reach out to the #contour channel in the Kubernetes Slack workspace.
• Mark this PR as fresh by commenting or pushing a commit
• Close this PR
• Offer to help out with triage

Please send feedback to the #contour channel in the Kubernetes Slack

[tsaarni]

@AkashKumar7902 Thank you for contributing!

Could you add small mention in the docs as well, e.g. this:

diff --git a/site/content/docs/main/config/access-logging.md b/site/content/docs/main/config/access-logging.md
index d3731a78f..bb1f5de64 100644
--- a/site/content/docs/main/config/access-logging.md
+++ b/site/content/docs/main/config/access-logging.md
@@ -151,6 +151,18 @@ json-fields:

 **Note:** The fingerprint values will be empty (`-`) for non-TLS connections or if the corresponding fingerprinting feature is not enabled.

+### Logging Trace and Span IDs
+
+When [tracing](tracing.md) is enabled, trace and span identifiers can be included in access logs.
+
+For text-based access logging, the following command operators can be used:
+- `%TRACE_ID%` - Trace identifier of the request
+- `%SPAN_ID%` - Span identifier of Envoy's span
+
+For JSON access logging, the following built-in fields can be added:
+- `trace_id`
+- `span_id`
+
 ## Using Access Log Formatter Extensions

 Envoy allows implementing custom access log command operators as extensions.
diff --git a/site/content/docs/main/config/tracing.md b/site/content/docs/main/config/tracing.md
index fb8c19762..c3841c9f7 100644
--- a/site/content/docs/main/config/tracing.md
+++ b/site/content/docs/main/config/tracing.md
@@ -120,5 +120,7 @@ kubectl logs deploy/simplest-collector -n projectcontour

 Now you should be able to see traces in the logs of the otel collector.

+Trace and span identifiers can also be included in [access logs](access-logging.md#logging-trace-and-span-ids) to correlate log entries with traces.
+
 [1]: https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/observability/tracing
 [2]: https://opentelemetry.io/

[tsaarni]

@AkashKumar7902 Thank you for contributing! I pushed the documentation updates directly to your branch.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.06%. Comparing base (8e2e6c4) to head (025bc2a).
⚠️ Report is 47 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7635      +/-   ##
==========================================
+ Coverage   82.38%   84.06%   +1.68%     
==========================================
  Files         130      131       +1     
  Lines       15873    14190    -1683     
==========================================
- Hits        13077    11929    -1148     
+ Misses       2510     2261     -249     
+ Partials      286        0     -286     

see 131 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.