Title: rbac: add unified matcher for RBAC filters

Description:

There are tons of issues marked as help wanted around RBAC. Some of them asking for new matchers (#4455, #6193, #15631), some of them requesting a unified, flexible and efficient matching mechanism for RBAC (#5569, #7918, #9376, #11832, #12285, #18064). Now, we already have a unified matching API, which can match network inputs (IP, port, SNI, protocol) and HTTP inputs (headers and trailers), almost everything what RBAC can handle now, with different matchers (list, map, trie) in any combinations.

There are some works to do:

1. Adapt connection/headers/stream info-based matcher. We currently do not have matchers for stream info like metadata and authentication, so we have to add one.
2. Add a custom matcher for CEL.
3. Add unified matcher for RBAC filters

I think it is a good first step to polish RBAC filters, we can merge connection/headers/stream info-based rules and CELs into an elegant and simple match tree, and we can also benefit from unified matcher and custom matchers, avoiding writing complex lengthy configurations and over and over again matching in the codes.