…dMatcher (grpc#9111)

This PR fixes a bug in the xDS RBAC authenticatedMatcher where it
incorrectly falls through URI/DNS SANs to the Subject DN. According to
gRFC A41 and Envoy's specification, only the first non-empty identity
source must be consulted. This bug allows an authorization bypass in
certain scenarios. A regression test is included.

RELEASE NOTES:
- xds/rbac: Fix `Authenticated` matcher to use the first non-empty
identity source (URI SAN, DNS SAN, and Subject DN) in the order
specified in gRFC A41.

RELEASE NOTES:
- xds/rbac: Fix Authenticated matcher to use the first non-empty
identity source (URI SAN, DNS SAN, and Subject DN) in the order
specified in gRFC A41.

Co-authored-by: Alan Ortega Alamo <alanortega7312@gmail.com>

This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `v1.81.0` → `v1.81.1` | ![age](https://developer.mend.io/api/mc/badges/age/go/google.golang.org%2fgrpc/v1.81.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/google.golang.org%2fgrpc/v1.81.0/v1.81.1?slim=true) |

---

### Release Notes

<details>
<summary>grpc/grpc-go (google.golang.org/grpc)</summary>

### [`v1.81.1`](https://github.com/grpc/grpc-go/releases/tag/v1.81.1): Release 1.81.1

[Compare Source](grpc/grpc-go@v1.81.0...v1.81.1)

### Security

- xds/rbac: Fix a potential authorization bypass caused by incorrectly falling through URI/DNS SANs to Subject Distinguished Name (DN) when matching the authenticated principal name. With this fix, only the first non-empty identity source will be used, as per [gRFC A41](https://github.com/grpc/proposal/blob/master/A41-xds-rbac.md). ([#&#8203;9111](grpc/grpc-go#9111))
  - Special Thanks: [@&#8203;al4an444](https://github.com/al4an444)

### Bug Fixes

- otel: Segregate client and server RPC information used for metrics and traces, to avoid one overwriting the other. ([#&#8203;9081](grpc/grpc-go#9081))

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDEuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEwMS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJ0eXBlL3BhdGNoIl19-->

Reviewed-on: https://git.erwanleboucher.dev/eleboucher/talos-mcp/pulls/2

Verified end-to-end alongside #109 in worktree lab-3865 (LAB-3865): build/vet/lint clean, go test -race ./... 19/19 packages PASS, live tests 7/7 PASS (vulnerable-api × 4 auth modes, grpc, dvga, crapi, 284 findings). Includes upstream security fix for xds/rbac authorization bypass (grpc/grpc-go#9111).