Fix request.reason.mode calcuation for glob and claims_to_roles expressions

[smallinsky]

Closes #54397
Closes gravitational/customer-sensitive-requests#700

What

The request.reason.mode: required force a user to provide a Access Request Description. The option is configurable and make forces a JIT issuer to provided desc why he is requesting access.

The current functionality was only checking literal value equlity instead of regexp and claims_to_roles matching rules.

Why we match the mode: required agains regexp or claims_to_roles ?

This is needed because the the by default support regexp and claims_to_roles that and this cases where missing from intimal requested reason functionality:

https://goteleport.com/docs/identity-governance/access-requests/access-request-configuration/#requiring-request-reasons

changelog: Fixed access request reason requirement (request.reason.mode: required) being ignored when requestable roles were specified with a wildcard, regexp, or claims_to_roles instead of literal role names.

Manual Test Plan

Test Environment

local env

Test Cases

• regexp match works:

  kind: role
  version: v7
  metadata:
    name: regexp-requester
  spec:
    allow:
      request:
        roles: ['^critical-.*$']
        reason:
          mode: required

• Glob match works:

 kind: role
 version: v7
 metadata:
   name: wildcard-requester
 spec:
   allow:
     request:
       roles: ['critical-*']
       reason:
         mode: required

• Claims to roles evaluation works:

  kind: role
  version: v7
  metadata:
    name: claims-requester
  spec:
    allow:
      request:
        claims_to_roles:
          - claim: 'logins'
            value: '*'
            roles: ['critical-access']
        reason:
          mode: required

TODO:

• Update docs.

[smallinsky]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: b8954bf96d

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[smallinsky]

friendly ping @ryanclark @gabrielcorado

[ryanclark]

I don't think we can merge today can we?