feat(googlepolicy): add DEBUG protojson wire logging and INFO policy-set apply logging

[dashpole]

Summary

Adds DEBUG-level single-line protojson wire logging and INFO-level policy-set application logging to the xDS policy manager in pkg/googlepolicy:

• Outgoing DiscoveryRequest (DEBUG): Logs "xDS DiscoveryRequest sent" (kind: "initial" | "ack" | "nack", version, response_nonce, and single-line discovery_request protojson including the full Node and error_detail) when zapcore.DebugLevel is enabled.
• Incoming DiscoveryResponse & Decoded TelemetryCollector (DEBUG): Logs "xDS DiscoveryResponse received" (with single-line discovery_response protojson and a structured JSON fallback if an Any resource cannot be resolved) and "Decoded xDS TelemetryCollector" (policy_set_revision, revision_create_time, policy_count, policy_ids) when zapcore.DebugLevel is enabled.
• Policy Set Application (INFO): Logs "Applied xDS policy set" (version, policy_set_revision, policies_loaded, policies_skipped) before sending an xDS ACK.

Example Log Output

1. Initial Connect + Successful Policy Set Application (rev-1)

INFO  Starting xDS policy manager  {"server": "127.0.0.1:8080", "fleet": "fleet-1", "collector_id": "collector-abc", "resource_name": "xdstp://telemetry-director.asia-east1.xds.googleapis.com/google.telemetry.xds.v1alpha1.TelemetryCollector/projects/my-project/fleets/fleet-1/collectors/default", "type_url": "type.googleapis.com/google.telemetry.xds.v1alpha1.TelemetryCollector"}
INFO  Connected to xDS server and sent DiscoveryRequest  {"server": "127.0.0.1:8080", "fleet": "fleet-1", "resource_name": "xdstp://...", "type_url": "type.googleapis.com/google.telemetry.xds.v1alpha1.TelemetryCollector"}
DEBUG xDS DiscoveryRequest sent  {"kind": "initial", "version": "", "response_nonce": "", "discovery_request": "{\"version_info\":\"\",\"node\":{\"id\":\"collector-abc\",\"cluster\":\"fleet-1\",\"metadata\":{\"cloud.region\":\"asia-east1\",\"gcp.fleet_id\":\"fleet-1\",\"gcp.project_id\":\"my-project\",\"service.instance.id\":\"collector-abc\"},\"locality\":{\"region\":\"asia-east1\",\"zone\":\"\",\"sub_zone\":\"\"}},\"resource_names\":[\"xdstp://...\"],\"type_url\":\"type.googleapis.com/google.telemetry.xds.v1alpha1.TelemetryCollector\",\"response_nonce\":\"\",\"error_detail\":null}"}
INFO  Received xDS DiscoveryResponse  {"version": "rev-1", "nonce": "nonce-1", "resources": 1}
DEBUG xDS DiscoveryResponse received  {"version": "rev-1", "nonce": "nonce-1", "discovery_response": "{\"version_info\":\"rev-1\",\"resources\":[{\"@type\":\"type.googleapis.com/google.telemetry.xds.v1alpha1.TelemetryCollector\",\"policy_set_revision\":\"projects/my-project/locations/global/policySets/fleet-1/revisions/rev-1\",\"policies\":[{\"@type\":\"type.googleapis.com/google.telemetry.policy.v1alpha1.LogFilterPolicy\",\"id\":\"drop-debug-logs\"}]}],\"type_url\":\"type.googleapis.com/google.telemetry.xds.v1alpha1.TelemetryCollector\",\"nonce\":\"nonce-1\"}"}
DEBUG Decoded xDS TelemetryCollector  {"version": "rev-1", "policy_set_revision": "projects/my-project/locations/global/policySets/fleet-1/revisions/rev-1", "revision_create_time": "2026-10-17T00:00:00Z", "policy_count": 1, "policy_ids": ["drop-debug-logs"]}
INFO  Applied xDS policy set  {"version": "rev-1", "policy_set_revision": "projects/my-project/locations/global/policySets/fleet-1/revisions/rev-1", "policies_loaded": 1, "policies_skipped": 0}
DEBUG xDS DiscoveryRequest sent  {"kind": "ack", "version": "rev-1", "response_nonce": "nonce-1", "discovery_request": "{\"version_info\":\"rev-1\",\"node\":{\"id\":\"collector-abc\",\"cluster\":\"fleet-1\",...},\"resource_names\":[\"xdstp://...\"],\"type_url\":\"type.googleapis.com/google.telemetry.xds.v1alpha1.TelemetryCollector\",\"response_nonce\":\"nonce-1\",\"error_detail\":null}"}

2. Failure Scenario A: Rejected Revision (Missing or Malformed policy_set_revision)

When a TelemetryCollector resource decodes but is rejected during validation (e.g. missing policy_set_revision), "Decoded xDS TelemetryCollector" is logged before rejection so operators can see which policies arrived, followed by the NACK DiscoveryRequest carrying error_detail and the previously applied version_info:

INFO  Received xDS DiscoveryResponse  {"version": "rev-missing-psr", "nonce": "nonce-2", "resources": 1}
DEBUG xDS DiscoveryResponse received  {"version": "rev-missing-psr", "nonce": "nonce-2", "discovery_response": "{\"version_info\":\"rev-missing-psr\",\"resources\":[{\"@type\":\"type.googleapis.com/google.telemetry.xds.v1alpha1.TelemetryCollector\",\"policies\":[{\"@type\":\"type.googleapis.com/google.telemetry.policy.v1alpha1.LogFilterPolicy\",\"id\":\"drop-debug-logs\"}]}],\"type_url\":\"type.googleapis.com/google.telemetry.xds.v1alpha1.TelemetryCollector\",\"nonce\":\"nonce-2\"}"}
DEBUG Decoded xDS TelemetryCollector  {"version": "rev-missing-psr", "policy_set_revision": "", "revision_create_time": "0001-01-01T00:00:00Z", "policy_count": 1, "policy_ids": ["drop-debug-logs"]}
WARN  Rejecting xDS revision  {"version": "rev-missing-psr", "error": "xDS TelemetryCollector resource is missing required field policy_set_revision"}
DEBUG xDS DiscoveryRequest sent  {"kind": "nack", "version": "rev-1", "response_nonce": "nonce-2", "discovery_request": "{\"version_info\":\"rev-1\",\"node\":{\"id\":\"collector-abc\",...},\"resource_names\":[\"xdstp://...\"],\"type_url\":\"type.googleapis.com/google.telemetry.xds.v1alpha1.TelemetryCollector\",\"response_nonce\":\"nonce-2\",\"error_detail\":{\"code\":3,\"message\":\"xDS TelemetryCollector resource is missing required field policy_set_revision\",\"details\":[]}}"}

3. Failure Scenario B: Undecodable google.protobuf.Any Resource (Unregistered Type URL)

When DiscoveryResponse contains an Any whose type URL is not in the collector's proto registry (causing protojson.Marshal to fail), "xDS DiscoveryResponse received" logs a structured single-line JSON fallback with marshal_error and metadata, followed by the NACK DiscoveryRequest:

INFO  Received xDS DiscoveryResponse  {"version": "rev-bad", "nonce": "nonce-3", "resources": 1}
DEBUG xDS DiscoveryResponse received  {"version": "rev-bad", "nonce": "nonce-3", "discovery_response": "{\"version_info\":\"rev-bad\",\"type_url\":\"type.googleapis.com/google.telemetry.xds.v1alpha1.TelemetryCollector\",\"nonce\":\"nonce-3\",\"resource_count\":1,\"marshal_error\":\"proto: not found\"}"}
WARN  Some xDS resources could not be decoded and will be skipped  {"version": "rev-bad", "error": "resource at index 0: failed to decode policy from xDS resource: unknown or unregistered type URL \"type.googleapis.com/does.not.Exist\": proto: not found"}
WARN  xDS revision could not be decoded, sending NACK  {"version": "rev-bad", "error": "resource at index 0: failed to decode policy from xDS resource: unknown or unregistered type URL \"type.googleapis.com/does.not.Exist\": proto: not found"}
DEBUG xDS DiscoveryRequest sent  {"kind": "nack", "version": "rev-1", "response_nonce": "nonce-3", "discovery_request": "{\"version_info\":\"rev-1\",\"node\":{\"id\":\"collector-abc\",...},\"resource_names\":[\"xdstp://...\"],\"type_url\":\"type.googleapis.com/google.telemetry.xds.v1alpha1.TelemetryCollector\",\"response_nonce\":\"nonce-3\",\"error_detail\":{\"code\":3,\"message\":\"resource at index 0: failed to decode policy from xDS resource: unknown or unregistered type URL \\\"type.googleapis.com/does.not.Exist\\\": proto: not found\",\"details\":[]}}"}

Testing

Verified with go test -race ./... in pkg/googlepolicy, including TestXDSPolicyManager_DebugProtoJSONAndAppliedPolicyLogging.