allow workloads access to wildcard namespace service queries

[tgross]

While testing work in consul-template to support cross-namespace queries of Nomad native services, I discovered that the List endpoint restricts querying using the wildcard namespace to ACL tokens with the read-job capability. This excludes the default Workload Identity policy. But the default policy can already read any specific namespace's service registrations, so this is just an oversight and not an intentional security control.

Update the code path we use for wildcard namespace queries to use the exact same check we have in the non-wildcard path.

This changeset also heavily refactors the tests for the List endpoint, which had a lot of redundant setup code that made it hard to follow what was actually under test. I've broken the test into ACLs and non-ACLs tests and then reduced the setup code to be shared, which will also reduce the time it takes to run the tests because we only wait for the keyring to be ready twice. (Ex. ~3s down to ~0.3s in local testing)

Ref: https://hashicorp.atlassian.net/browse/NMD-920
Ref: hashicorp/consul-template#2182

Testing & Reproduction steps

With a replace statement in the go.mod pointing to hashicorp/consul-template#2182, you can deploy the following job to multiple namespaces (one of which should be named "prod") and see the cross-query listing work.

example.nomad.hcl

job "example" {

  group "web" {

    network {
      mode = "bridge"
      port "www" {
        to = 8001
      }
    }

    service {
      name     = "httpd-web"
      provider = "nomad"
      port     = "www"
    }

    task "http" {

      driver = "docker"

      config {
        image   = "busybox:1"
        command = "httpd"
        args    = ["-vv", "-f", "-p", "8001", "-h", "/local"]
        ports   = ["www"]
      }

      template {
        data = <<EOF
  template {
    data = <<EOF
# Configuration for a single NGINX upstream service.
upstream my_app {
  {{- range nomadService "httpd-web?ns=prod" }}
  server {{ .Address }}:{{ .Port }};{{- end }}
}

# Configuration for all services in the prod namespace as an NGINX upstream
# service, showing how to interpolate the .Name field into the parameter.
{{ range nomadServices "?ns=*" }}
upstream {{ .Name | toLower }} {
  {{ $arg := printf "%s?ns=%s" .Name .Namespace }}
  {{- range nomadService $arg }}
  server {{ .Address}}:{{ .Port }};{{- end }}
}
{{ end -}}
EOF

        destination = "local/nginx.conf"
      }

      shutdown_delay = "1s"

      resources {
        cpu    = 100
        memory = 100
      }

    }
  }
}

Contributor Checklist

• Changelog Entry If this PR changes user-facing behavior, please generate and add a
  changelog entry using the make cl command.
• Testing see above
• Documentation n/a
• LLM Usage n/a

Reviewer Checklist

• Backport Labels Please add the correct backport labels as described by the internal
  backporting document.
• Commit Type Ensure the correct merge method is selected which should be "squash and merge"
  in the majority of situations. The main exceptions are long-lived feature branches or merges where
  history should be preserved.
• Enterprise PRs If this is an enterprise only PR, please add any required changelog entry
  within the public repository.

• If a change needs to be reverted, we will roll out an update to the code within 7 days.

Changes to Security Controls

Are there any changes to security controls (access controls, encryption, logging) in this pull request? If so, explain.

[tehut]

LGTM! A lot more readable.

[tehut]

I've never seen this syntax before and had to make a dumb playground example to make myself believe it.

This is cool!!!