[management,proxy] Add agentgateway integration (#7274)

* [management] Add agentgateway provider catalog entry

Allow Agent Network providers to target an operator-supplied agentgateway proxy while stamping trusted NetBird identity headers.

Signed-off-by: Daneyon Hansen <daneyon.hansen@solo.io>

* [proxy] Allow trusted Agent Network identity headers

Permit only the built-in identity injector to replace the two reserved agentgateway attribution headers while keeping them blocked for every other middleware.

Signed-off-by: Daneyon Hansen <daneyon.hansen@solo.io>

* [management,proxy] Add multi-vendor gateway routing

Let one Agent Network route declare multiple parser surfaces while preserving the existing singular vendor wire field.

Signed-off-by: Daneyon Hansen <daneyon.hansen@solo.io>

* [management] Update router test for model policies

Signed-off-by: Daneyon Hansen <daneyon.hansen@solo.io>

* [proxy] Cover reserved header policy

Signed-off-by: Daneyon Hansen <daneyon.hansen@solo.io>

* [management] Add agentgateway model discovery

Use agentgateway's OpenAI-compatible models endpoint and omit wildcard patterns until NetBird can authorize and price them consistently.

Signed-off-by: Daneyon Hansen <daneyon.hansen@solo.io>

---------

Signed-off-by: Daneyon Hansen <daneyon.hansen@solo.io>

proxy/internal/middleware/headerpolicy.go

@@ -2,6 +2,8 @@ package middleware
 
 import "strings"
 
+const trustedIdentityMiddlewareID = "llm_identity_inject"
+
 var denyHeaders = []string{
 	"Authorization",
 	"Connection",
@@ -78,18 +80,22 @@ func isHeaderFieldName(name string) bool {
 // header names so the dispatcher can increment the blocked-header
 // metric.
 func FilterHeaderMutations(m *Mutations) (filteredAdd []KV, filteredRemove []string, blocked []string) {
+	return filterHeaderMutations(m, "")
+}
+
+func filterHeaderMutations(m *Mutations, middlewareID string) (filteredAdd []KV, filteredRemove []string, blocked []string) {
 	if m == nil {
 		return nil, nil, nil
 	}
 	for _, kv := range m.HeadersAdd {
-		if IsHeaderMutable(kv.Key) {
+		if IsHeaderMutable(kv.Key) || isTrustedIdentityHeader(middlewareID, kv.Key) {
 			filteredAdd = append(filteredAdd, kv)
 			continue
 		}
 		blocked = append(blocked, kv.Key)
 	}
 	for _, name := range m.HeadersRemove {
-		if IsHeaderMutable(name) {
+		if IsHeaderMutable(name) || isTrustedIdentityHeader(middlewareID, name) {
 			filteredRemove = append(filteredRemove, name)
 			continue
 		}
@@ -97,3 +103,11 @@ func FilterHeaderMutations(m *Mutations) (filteredAdd []KV, filteredRemove []str
 	}
 	return filteredAdd, filteredRemove, blocked
 }
+
+func isTrustedIdentityHeader(middlewareID, name string) bool {
+	if middlewareID != trustedIdentityMiddlewareID {
+		return false
+	}
+	return strings.EqualFold(name, "x-netbird-user-id") ||
+		strings.EqualFold(name, "x-netbird-groups")
+}