Cilium - v1.12.15

We are pleased to release Cilium v1.12.15. This is bug fix release addressing the recent HTTP/2 Stream Cancellation Attack (CVE-2023-44487) and other bugs:
- Envoy GHSA-jhv4-f7mr-xx76
- Go GHSA-qppj-fm5r-hxr3

Summary of Changes

Minor Changes:
* bump grpc dependency to 1.56.3 to fix security vulnerability https://github.com/advisories/GHSA-qppj-fm5r-hxr3 (#28529, @aanm)
* vendor, azure: Bump Azure SDK to Aug 2021 (Backport PR #28317, Upstream PR #28311, @christarazi)

Bugfixes:
* Add drop notifications for various error paths in the datapath. (Backport PR #28437, Upstream PR #25183, @julianwiedmann)
* Add drop notifications from various error paths in the BPF datapath. (Backport PR #28444, Upstream PR #26956, @julianwiedmann)
* bpf: fix error handling for invoke_tailcall_if() (Backport PR #28414, Upstream PR #26118, @julianwiedmann)
* bpf: lxc: fix one missing drop notification in CT lookup tail calls (Backport PR #28351, Upstream PR #26115, @julianwiedmann)
* envoy: Sync supported resources to fix not found issue (Backport PR #28351, Upstream PR #28272, @sayboras)
* Fix a bug that causes pod-to-pod traffic between nodes to be dropped when IPsec is enabled and kube-proxy installed rules in both iptables-nft and iptables-legacy. (Backport PR #28444, Upstream PR #28258, @pchaigno)
* Fix missing drop notifications on conntrack lookup failures when IPv4 and IPv6 are both enabled or socket-level load balancing is disabled. (Backport PR #28295, Upstream PR #25426, @bleggett)
* Fix the trace notification for hairpinned reply traffic, to indicate the correct security identity for the client. (Backport PR #28295, Upstream PR #28133, @julianwiedmann)
* Fixes a bug causing panic when counting IPsec keys number via "cilium encrypt status". (Backport PR #28295, Upstream PR #27996, @jschwinger233)
* pkg/node: Updates GetIPv6AllocCIDRs() to Properly Return Secondary CIDRs (Backport PR #28104, Upstream PR #27855, @danehans)

CI Changes:
* [v1.12] ci: Add a call to the update label backport action (#27879, @pippolo84)
* [v1.14] GHA: Add clustermesh upgrade and downgrade tests (Backport PR #28564, Upstream PR #28355, @giorio94)
* CI: Add conn-disrupt-test action for reuse (Backport PR #28152, Upstream PR #27567, @jschwinger233)
* CI: Add conn-disrupt-test action for reuse (Backport PR #28295, Upstream PR #27567, @jschwinger233)
* CI: Add IPsec key rotation test (Backport PR #28152, Upstream PR #27203, @jschwinger233)
* CI: Move IPsec CI jobs into separate pipelines (Backport PR #28152, Upstream PR #26730, @jschwinger233)
* ci: Run BPF lints on workflow definition changes (Backport PR #28295, Upstream PR #28122, @qmonnet)
* ci: update k8s versions support for v1.12 (#28246, @nbusseneau)
* Do not hardcode the AWS VPC CNI plugin version in the conformance-aws-cni GHA workflow (Backport PR #28444, Upstream PR #28392, @giorio94)
* Refactor CiliumExecContext() Retry Logic (Backport PR #28295, Upstream PR #28131, @carnerito)
* Update image registry to quay.io (Backport PR #28295, Upstream PR #23093, @oxxenix)
* v1.12: manual backport of #27193 (#28227, @nbusseneau)
* workflows/ipsec: Add missing --flush-ct for key rotation (Backport PR #28152, Upstream PR #27883, @pchaigno)

Misc Changes:
* chore(deps): update all github action dependencies (v1.12) (patch) (#28114, @renovate[bot])
* chore(deps): update all github action dependencies to v3 (v1.12) (major) (#28116, @renovate[bot])
* chore(deps): update all lvh-images main (v1.12) (patch) (#27948, @renovate[bot])
* chore(deps): update all lvh-images main (v1.12) (patch) (#28215, @renovate[bot])
* chore(deps): update aws-actions/configure-aws-credentials action to v4 (v1.12) (#28117, @renovate[bot])
* chore(deps): update dependency cilium/hubble to v0.12.1 (v1.12) (#28526, @renovate[bot])
* chore(deps): update dependency cilium/hubble to v0.12.2 (v1.12) (#28568, @renovate[bot])
* chore(deps): update docker.io/library/golang docker tag to v1.20.10 (v1.12) (#28517, @renovate[bot])
* chore(deps): update docker.io/library/golang:1.20.8 docker digest to 700d726 (v1.12) (#28113, @renovate[bot])
* chore(deps): update docker.io/library/ubuntu:20.04 docker digest to 0b5642e (v1.12) (#28582, @renovate[bot])
* chore(deps): update docker/build-push-action action to v4.2.1 (v1.12) (#28115, @renovate[bot])
* chore(deps): update docker/build-push-action action to v5 (v1.12) (#28118, @renovate[bot])
* chore(deps): update myrotvorets/set-commit-status-action action to v2 (v1.12) (#28119, @renovate[bot])
* chore(deps): update quay.io/cilium/hubble docker tag to v0.12.1 (v1.12) (#28544, @renovate[bot])
* chore(deps): update quay.io/cilium/hubble docker tag to v0.12.2 (v1.12) (#28573, @renovate[bot])
* ci: fix AWS EKS K8s versions comment (Backport PR #28295, Upstream PR #28249, @nbusseneau)
* docs: Add more details for the Cluster Mesh key rotation (Backport PR #28295, Upstream PR #28145, @margamanterola)
* docs: egressgw: document incompatibility with Clustermesh (Backport PR #28104, Upstream PR #27918, @julianwiedmann)
* docs: Makefile, check-build.sh clean-ups and perf improvements (Backport PR #28295, Upstream PR #28161, @qmonnet)
* docs: Mention RouteTableInterfacesOffset in system requirements (Backport PR #28444, Upstream PR #28358, @gandro)
* docs: Update Sphinx and its dependencies, Cilium theme (Backport PR #28295, Upstream PR #28172, @qmonnet)
* Fix potential nil pointer dereference in SelectorManager implementation (Backport PR #28104, Upstream PR #27805, @learnitall)
* fix(deps): update module golang.org/x/net to v0.17.0 [security] (#28552, @aanm)
* install/kubernetes: add the cilium/values.yaml target to .PHONY (Backport PR #28295, Upstream PR #28225, @nbusseneau)
* ipsec: Atomically upgrade XFRM states with new output-mark (Backport PR #28564, Upstream PR #28485, @pchaigno)
* Update docs theme (Backport PR #28444, Upstream PR #28403, @raphink)
* Update Hubble UI from v0.11.0 to v0.12.1 (#28536, @rolinh)

Other Changes:
* Backport v1.12: FQDN fixes (#28138, @joamaki)
* cocci: backport fix about incorrect warnings and resolve warning related to a const qualifier (#28287, @giorio94)
* envoy: Bump envoy version to v1.24.11 (#28501, @sayboras)