feat: chaitin waf response logging

[blaisewang]

Description

lua-resty-t1k 1.2.0 can report the response to the SafeLine WAF detection service in addition to the request. This PR bumps the dependency and exposes the capability through the chaitin-waf plugin.

Until now the plugin only reported requests, so anything the WAF could have detected on the way out — data leaks in a response body, a successful exploit's output, an unexpected status code — was invisible to SafeLine. Enabling response reporting closes that gap without changing how requests are handled.

Three new config options, available both at plugin level and in the plugin metadata:

Option	Type	Default	Description
log_resp	boolean	false	Report the response to the WAF service.
resp_body_size	integer (>= 0)	4	How much of the response body to report, in KB. 0 reports only the status line and headers.
extra_ignored_content_types	string	—	Comma separated response Content-Type values to skip, on top of the built-in list.

How it works:

• The plugin now implements the body_filter and log phases, delegating to t1k.do_body_filter() and t1k.do_log().
• body_filter buffers up to resp_body_size KB of the response body; the report itself is sent from an ngx.timer during the log phase, after the response has been handed back to the client. It therefore adds no latency to the response.
• The report is advisory only: detection results appear in the SafeLine console, and APISIX never blocks or modifies a response based on them. Request handling is unchanged.
• Responses are skipped when the request was already blocked, or when the response Content-Type is in the ignored list (audio, video, font, image and other binary media types out of the box).

One refactor was needed along the way: get_conf applied the metadata and plugin level config blocks with two verbatim copies of the same field-by-field assignment. Adding three more options would have meant keeping three copies in sync, so both are folded into a local helper. Precedence is unchanged — plugin level config still overrides metadata.

Docs updated in both en and zh, including a new "Response Logging" section that covers the async reporting model, the skip conditions, and the memory cost of buffering response bodies on routes serving large responses.

Which issue(s) this PR fixes:

N/A — no existing issue; this adds a new capability to the plugin.

Checklist

• I have explained the need for this PR and the problem it solves
• I have explained the changes or the new features added to this PR
• I have added tests corresponding to this change
• I have updated the documentation to reflect this change
• I have verified that this change is backward compatible (If not, please discuss on the APISIX mailing list first)

[membphis]

Two P2 issues need to be addressed before merge:

1. Response reporting can fail silently, and the tests do not verify the core behavior. ngx.timer.at does not consume callback return values, so connect/send/receive failures returned by socket.do_socket are neither logged nor measured. Tests 18-21 only verify configuration acceptance and the client response; they do not prove that the mock WAF receives the response status, headers, and truncated body, or that ignored content types are skipped. Please add observable error handling and an end-to-end assertion with bounded polling for the asynchronous report.

2. The required exact-head CI is failing. The t/plugin/[a-k]*.t job is red in kafka-logger.t TEST 18 because the expected partition_id: 1 and partition_id: 2 log entries are missing. This appears outside the files changed by this PR, but the required check still needs to pass before merge. Please rerun it and investigate if the failure is reproducible: failed job.

[blaisewang]

Two P2 issues need to be addressed before merge:

1. Response reporting can fail silently, and the tests do not verify the core behavior. ngx.timer.at does not consume callback return values, so connect/send/receive failures returned by socket.do_socket are neither logged nor measured. Tests 18-21 only verify configuration acceptance and the client response; they do not prove that the mock WAF receives the response status, headers, and truncated body, or that ignored content types are skipped. Please add observable error handling and an end-to-end assertion with bounded polling for the asynchronous report.
2. The required exact-head CI is failing. The t/plugin/[a-k]*.t job is red in kafka-logger.t TEST 18 because the expected partition_id: 1 and partition_id: 2 log entries are missing. This appears outside the files changed by this PR, but the required check still needs to pass before merge. Please rerun it and investigate if the failure is reproducible: failed job.

1. Fixed in lua-resty-t1k 1.2.1 — ngx.timer.at discarded the callback's return values, so do_socket failures are now logged at error level, and the dependency is bumped here. Added t/plugin/chaitin-waf-log-resp.t, which asserts the report is actually sent, that a 4096-byte response is truncated to 1024 for reporting while the client still gets all 4096, that ignored content types and log_resp: false skip it, and that delivery failures are logged.

2. Unrelated to this PR. CI should pass on rerun.