implement pluggable rule filtering system with pipeline intentions

[joejstuart]

feat: implement pluggable rule filtering system with pipeline intentions

• Add extensible filtering framework with RuleFilter interface
• Implement PipelineIntentionFilter for filtering rules by pipeline intentions
• Implement IncludeListFilter for filtering by collections, packages, and rules
• Add pipeline_intention metadata field to rule annotations
• Fix filtering leak by ensuring AllNamespaces=false prevents bypassing filters
• Add comprehensive test coverage for all filtering components
• Maintain backward compatibility with existing filtering logic

The new system allows for flexible rule filtering based on pipeline intentions
and include lists, while preventing any evaluation of excluded namespaces
regardless of filtering results.

Assisted by: Cursor (powered by Claude 4 Sonnet)

[joejstuart]

I have a fix coming for the acceptance test errors.

[simonbaird]

Is it likely to happen for real? How will the user deal with it? Would it be better to throw an error? Or do we have some handling for this later that presents the situation to the user?

[simonbaird]

I'm just wondering, not a blocker to merge.

[joejstuart]

Yeah, we set it to nil during evaluation now. It still could use improvement. Here is an update 37a790f

[simonbaird]

High level suggestions/comments/thoughts:

• I think I like the filtering mechanism, and it feels like it's useful no matter what. However I wonder if we could add it with just the include filtering in a nice tidy PR. Then introduce the pipeline_intention filtering support separately.
• The more I think about it, the more I wonder why we need this new special "pipeline_intention" filter. What if we put all the pipeline intention rules in a collection called "redhat-release", then just included them by collection? It might require some extra flags to do --include-only "@redhat-release" on the command line, and have that override or merge with the include from the ECP.

[joejstuart]

High level suggestions/comments/thoughts:

• I think I like the filtering mechanism, and it feels like it's useful no matter what. However I wonder if we could add it with just the include filtering in a nice tidy PR. Then introduce the pipeline_intention filtering support separately.
• The more I think about it, the more I wonder why we need this new special "pipeline_intention" filter. What if we put all the pipeline intention rules in a collection called "redhat-release", then just included them by collection? It might require some extra flags to do --include-only "@redhat-release" on the command line, and have that override or merge with the include from the ECP.

We can look at including it as a collection, but it takes on multiple values (release, production, staging). I noticed it's being used in ITS's with pipeline_intention=staging. We'd probably want to investigate more if we change how this works so we don't break anyone.

[simonbaird]

We can look at including it as a collection, but it takes on multiple values

Yeah good point. It think let's go ahead with this design and maybe consider other options long term.

[simonbaird]

I had one or two minor suggestions, but overall lgtm.