perf(rules): add withNegation flag to simplify to policy flow

[lukidzi]

Motivation

Note

This is not a problem when using meshServices.mode: Exclusive with policies in a new style

When a user has multiple to policies for a single top-level target reference and a default to Mesh target, CPU usage spikes due to the expensive matching process.

Implementation information

After analyzing the issue with @lobkovilya, we discovered that for to policies, our logic checks every permutation of tags. However, this is unnecessary because the only possible tags for to policies are kuma.io/service, or no tags at all when the target is Mesh.

The only exception is MeshHTTPRoute, where we generate the __rule-matches-hash__ tag, which points to a hash of the matcher. Since we don’t need to evaluate all permutations, we decided to iterate through the subsets and match them directly with the policies. To optimize further, we first deduplicate entries to avoid redundant computations.

After implementing these changes, I deployed the update and ran a performance profile, which showed significant improvements.

fix: #13149

[github-actions]

Reviewer Checklist

🔍 Each of these sections need to be checked by the reviewer of the PR 🔍:
If something doesn't apply please check the box and add a justification if the reason is non obvious.

• Is the PR title satisfactory? Is this part of a larger feature and should be grouped using > Changelog?
• PR description is clear and complete. It Links to relevant issue as well as docs and UI issues
• This will not break child repos: it doesn't hardcode values (.e.g "kumahq" as an image registry)
• IPv6 is taken into account (.e.g: no string concatenation of host port)
• Tests (Unit test, E2E tests, manual test on universal and k8s)
  • Don't forget ci/ labels to run additional/fewer tests
• Does this contain a change that needs to be notified to users? In this case, UPGRADE.md should be updated.
• Does it need to be backported according to the backporting policy? (this GH action will add "backport" label based on these file globs, if you want to prevent it from adding the "backport" label use no-backport-autolabel label)