Per-Filter Failure Modes

[shaneutt]

Today any Err(FilterError) propagates immediately and results in a 500 — every filter is implicitly fail-closed with no per-filter override. Adding an optional failure_mode field to FilterEntry (defaulting to closed for backwards compat) would cover this:

filter_chains:
  - name: inference
    filters:
      - filter: ext_auth
        failure_mode: closed   # reject on error (default)
        grpc_address: "authorino:50051"
      - filter: ext_proc
        failure_mode: closed   # guardrails must not be bypassed
        grpc_address: "payload-processing:9004"
      - filter: access_log
        failure_mode: open     # don't block requests if logging fails

This also means #17 and #14 get failure modes for free at the pipeline level rather than each reimplementing their own.

• everything by default is closed
• some benign filters (e.g. observe) could default to open
• overrides need to be available on any individual filter