Backport of VAULT-3825: Wildcard ACL policies without a trailing slash should match LIST operations into release/1.13.x

[hc-github-team-secure-vault-core]

Backport

This PR is auto-generated from #23874 to be assessed for backporting due to the inclusion of the label backport/1.13.x.

The below text is copied from the body of the original PR.

---

I'll split this into an OSS PR and add a changelog there once it's approved.

When a LIST operation is executed on namespace foo, both of the following policies will independently allow the operation:

path "foo/sys/policies/acl" {
	capabilities = ["list"]
}

and

path "foo/sys/policies/acl/" {
	capabilities = ["list"]
}

both work 👍

However, when we use a wildcard in the policy path, we get different behavior:

path "+/sys/policies/acl" {
	capabilities = ["list"]
}

^ this fails

path "+/sys/policies/acl/" {
	capabilities = ["list"]
}

but ^ this succeeds.

This PR fixes the behavior so that it's the same for a wildcard versus no wildcard.

I considered stripping the trailing slash earlier in the request flow, but that would mean that any users that had written rules assuming that there was a trailing slash would need to update their policies after this change.

Tests for this are in enterprise.

---

Overview of commits

• fb97a45

[github-actions]

Build Results:
All builds succeeded! ✅

[github-actions]

CI Results:
All Go tests succeeded! ✅