Add support for filter chains (#6820)

Motivation:

Listener `filter_chains` and `default_filter_chain` were not resolved
into the snapshot tree, so consumers could not access per-filter-chain
transport socket or route configurations. The server-side
`DownstreamTlsContext` was also not supported, meaning downstream TLS
certificates could not be resolved. Additionally, internal extension
factories were loaded via SPI and could be overridden by user code.

Modifications:

**Filter chain resolution**
- Added `FilterChainSnapshot` to hold the resolved match criteria,
transport socket, and route snapshot for each filter chain, including
`toDebugString()`.
- Added `ListenerFilterChainFactory` to resolve each `FilterChain` into
a `FilterChainSnapshot` by extracting HCM and resolving routes and
transport sockets.
- Extended `ListenerSnapshot` with `filterChains()`,
`defaultFilterChain()`, and updated `routeSnapshot()` to fall back
through api_listener → filter chains → default filter chain. Updated
`toDebugString()` to delegate to `FilterChainSnapshot.toDebugString()`.

**Downstream TLS support**
- Added `DownstreamTlsTransportSocketFactory` to support server-side
`DownstreamTlsContext` with multiple TLS certificates.
- Extracted `resolveValidationContext()` and `resolveTlsCertificates()`
from `UpstreamTlsTransportSocketFactory` into `TransportSocketFactory`
as shared static methods. `resolveTlsCertificates()` now resolves all
certificates (not just the first), returning
`SnapshotStream<List<TlsCertificateSnapshot>>`.
- Updated `TransportSocketSnapshot` to hold
`List<TlsCertificateSnapshot>` instead of
`Optional<TlsCertificateSnapshot>`.
- Added fail-fast validation in `UpstreamTlsTransportSocketFactory` to
reject more than one TLS certificate before creating any streams.

**Server-side HTTP filters**
- Added `XdsHttpFilter.serviceDecorator()` returning `@Nullable
DecoratingHttpServiceFunction` for server-side filter support.
- Added `buildDownstreamServerFilter()` in `FilterUtil` to compose
server-side filter chains using `DelegatingHttpService` as the terminal
service.
- Added `RouteEntry.httpService()` to expose the composed server-side
`HttpService`.
- Added `CachingStream` to deduplicate filter instantiation across
routes sharing the same merged filter config.

**Extension registry**
- Moved internal extension factories (`RouterFilterFactory`,
`CredentialInjectorFilterFactory`, `StaticClusterTypeFactory`,
`StrictDnsClusterTypeFactory`) from SPI to explicit built-in
registration in `XdsExtensionRegistry` with `buildKeepingLast()`
precedence (builtin > builder > SPI). Deleted the now-empty SPI service
files.
- Added `XdsBootstrapBuilder.extensionFactories()` varargs and
`Iterable` overloads for registering custom extension factories.

Result:

- `ListenerSnapshot` now fully resolves `filter_chains` and
`default_filter_chain`, enabling filter-chain-level TLS and routing.
- Downstream (server-side) TLS supports multiple certificates; upstream
enforces at most one.
- Internal extension factories can no longer be overridden via SPI.
- Server-side HTTP filter chains are resolved and accessible via
`RouteEntry.httpService()`.

Author: jrhee17

it/xds-client/src/test/java/com/linecorp/armeria/xds/it/ConfigSourceLifecycleObserverTest.java

@@ -492,10 +492,7 @@ void separateConfigSources() throws Exception {
     private static final String malformedListenerYaml =
             """
                 name: my-listener
-                api_listener:
-                  api_listener:
-                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager\
-                .v3.HttpConnectionManager
+                connection_balance_config: {}
                 """;
 
     //language=YAML

it/xds-client/src/test/java/com/linecorp/armeria/xds/it/ErrorHandlingTest.java

@@ -344,10 +344,7 @@ public void onUpdate(@Nullable Object snapshot, @Nullable Throwable t) {
                 static_resources:
                   listeners:
                     - name: my-listener
-                      api_listener:
-                        api_listener:
-                          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager\
-            .v3.HttpConnectionManager
+                      connection_balance_config: {}
             """;
 
     public static Stream<Arguments> staticResourceValidationFailure_args() {
@@ -357,7 +354,7 @@ public static Stream<Arguments> staticResourceValidationFailure_args() {
                 Arguments.of(malformedSecondaryStaticClusterBootstrapYaml,
                              "name: length must be at least 1 but got: 0"),
                 Arguments.of(malformedStaticListenerBootstrapYaml,
-                             "stat_prefix: length must be at least 1 but got: 0")
+                             "balance_type: is required")
         );
     }
 
@@ -377,10 +374,7 @@ void staticResourceValidationFailure(String bootstrapYaml, String errorMsg) thro
     private static final String malformedListenerYaml =
             """
                 name: my-listener
-                api_listener:
-                  api_listener:
-                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager\
-            .v3.HttpConnectionManager
+                connection_balance_config: {}
             """;
 
     //language=YAML
@@ -525,7 +519,7 @@ private static Stream<Arguments> listenerRootDynamicResourceValidationFailure_ar
                                                    ImmutableList.of(), version.toString());
         return Stream.of(
                 Arguments.of(snapshot1, XdsType.LISTENER, "my-listener",
-                             "stat_prefix: length must be at least 1 but got: 0"),
+                             "balance_type: is required"),
                 Arguments.of(snapshot2, XdsType.ROUTE, "my-route",
                              "domains: must have at least 1 items"),
                 Arguments.of(snapshot3, XdsType.CLUSTER, "my-cluster",

it/xds-client/src/test/java/com/linecorp/armeria/xds/it/FilterChainIntegrationTest.java

@@ -0,0 +1,149 @@
+/*
+ * Copyright 2026 LY Corporation
+ *
+ * LY Corporation licenses this file to you under the Apache License,
+ * version 2.0 (the "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at:
+ *
+ *   https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations
+ * under the License.
+ */
+
+package com.linecorp.armeria.xds.it;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.awaitility.Awaitility.await;
+
+import java.util.concurrent.atomic.AtomicReference;
+
+import org.junit.jupiter.api.Test;
+
+import com.linecorp.armeria.xds.FilterChainSnapshot;
+import com.linecorp.armeria.xds.ListenerRoot;
+import com.linecorp.armeria.xds.ListenerSnapshot;
+import com.linecorp.armeria.xds.XdsBootstrap;
+
+import io.envoyproxy.envoy.config.bootstrap.v3.Bootstrap;
+
+class FilterChainIntegrationTest {
+
+    @Test
+    void filterChainSnapshots() {
+        //language=YAML
+        final Bootstrap bootstrap = XdsResourceReader.fromYaml("""
+                static_resources:
+                  listeners:
+                    - name: test-listener
+                      filter_chains:
+                      - filters:
+                        - name: envoy.filters.network.http_connection_manager
+                          typed_config:
+                            "@type": type.googleapis.com/envoy.extensions.filters.network\
+                .http_connection_manager.v3.HttpConnectionManager
+                            stat_prefix: chain1
+                            route_config:
+                              name: route_chain1
+                              virtual_hosts:
+                              - name: vh1
+                                domains: [ "*" ]
+                                routes:
+                                - match:
+                                    prefix: /
+                                  route:
+                                    cluster: test-cluster
+                            http_filters:
+                            - name: envoy.filters.http.router
+                              typed_config:
+                                "@type": type.googleapis.com/envoy.extensions.filters.http\
+                .router.v3.Router
+                      - filters:
+                        - name: envoy.filters.network.http_connection_manager
+                          typed_config:
+                            "@type": type.googleapis.com/envoy.extensions.filters.network\
+                .http_connection_manager.v3.HttpConnectionManager
+                            stat_prefix: chain2
+                            route_config:
+                              name: route_chain2
+                              virtual_hosts:
+                              - name: vh2
+                                domains: [ "*" ]
+                                routes:
+                                - match:
+                                    prefix: /
+                                  route:
+                                    cluster: test-cluster
+                            http_filters:
+                            - name: envoy.filters.http.router
+                              typed_config:
+                                "@type": type.googleapis.com/envoy.extensions.filters.http\
+                .router.v3.Router
+                      default_filter_chain:
+                        filters:
+                        - name: envoy.filters.network.http_connection_manager
+                          typed_config:
+                            "@type": type.googleapis.com/envoy.extensions.filters.network\
+                .http_connection_manager.v3.HttpConnectionManager
+                            stat_prefix: default_chain
+                            route_config:
+                              name: route_default
+                              virtual_hosts:
+                              - name: vh_default
+                                domains: [ "*" ]
+                                routes:
+                                - match:
+                                    prefix: /
+                                  route:
+                                    cluster: test-cluster
+                            http_filters:
+                            - name: envoy.filters.http.router
+                              typed_config:
+                                "@type": type.googleapis.com/envoy.extensions.filters.http\
+                .router.v3.Router
+                  clusters:
+                    - name: test-cluster
+                      type: STATIC
+                      load_assignment:
+                        cluster_name: test-cluster
+                        endpoints:
+                        - lb_endpoints:
+                          - endpoint:
+                              address:
+                                socket_address:
+                                  address: 127.0.0.1
+                                  port_value: 8080
+                """, Bootstrap.class);
+
+        final AtomicReference<ListenerSnapshot> snapshotRef = new AtomicReference<>();
+        try (XdsBootstrap xdsBootstrap = XdsBootstrap.of(bootstrap)) {
+            final ListenerRoot listenerRoot = xdsBootstrap.listenerRoot("test-listener");
+            listenerRoot.addSnapshotWatcher((snapshot, t) -> {
+                if (snapshot != null) {
+                    snapshotRef.set(snapshot);
+                }
+            });
+
+            await().untilAsserted(() -> {
+                assertThat(snapshotRef.get()).isNotNull();
+                final ListenerSnapshot snapshot = snapshotRef.get();
+
+                // Verify filter chains
+                assertThat(snapshot.filterChains()).hasSize(2);
+
+                final FilterChainSnapshot chain0 = snapshot.filterChains().get(0);
+                assertThat(chain0.routeSnapshot()).isNotNull();
+
+                final FilterChainSnapshot chain1 = snapshot.filterChains().get(1);
+                assertThat(chain1.routeSnapshot()).isNotNull();
+
+                // Verify default filter chain
+                assertThat(snapshot.defaultFilterChain()).isNotNull();
+                assertThat(snapshot.defaultFilterChain().routeSnapshot()).isNotNull();
+            });
+        }
+    }
+}