tighten and document path regex

Author: BenTheElder

infra/gcp/terraform/modules/oci-proxy/cloud-armor.tf

@@ -69,7 +69,14 @@ resource "google_compute_security_policy" "cloud-armor" {
     priority = "1"
     match {
       expr {
-        expression = "!request.path.matches('(?:^/$)|(?:^/privacy$)|(?:^/v2/)')"
+        # allow:
+        # our homepage info redirect: /
+        # our privacy info redirect: /privacy
+        # OCI ping: /v2
+        # OCI pull / list calls: /v2/<name>/(blobs|manifests|tags)/<reference>
+        # https://github.com/opencontainers/distribution-spec/blob/main/spec.md#endpoints
+        # NOTE: AR doesn't support referrers API
+        expression = "!request.path.matches('(?:^/?$)|(?:^/privacy$)|(?:^/v2/?$)|(?:^/v2/.+/(:?blobs|manifests|tags)/.+$)')"
       }
     }
   }