aws-cf-reverse-proxy: add per-behavior gRPC support via grpc_routes

[sam-at-luther]

Closes #63
Companion follow-up: luthersystems/ui-infrastructure#241

Summary

Adds opt-in gRPC support to aws-cf-reverse-proxy so consumers can register CloudFront cache behaviors that speak gRPC to an EKS ALB origin. Existing distributions with no grpc_routes set produce a zero-diff plan.

Changes

• vars.tf: new grpc_routes = map(string) (default {}).
• main.tf:
  • New local.grpc_origin_configs derives an origin per gRPC route with a distinct origin-grpc-... id. A combined local.all_origin_configs feeds the dynamic "origin" block; when grpc_routes = {} it is identical to local.origin_configs, preserving the exact origin set.
  • http_version flips to http2and3 only when length(grpc_routes) > 0, otherwise stays http2.
  • New dynamic "ordered_cache_behavior" iterates grpc_origin_configs and emits grpc_config { enabled = true } plus the full method set CloudFront requires for gRPC behaviors. Reuses the existing cache and response-headers policies.

Design notes

• gRPC origins use origin-grpc-<sanitized-path> ids so they never collide with HTTP origins, even when the underlying origin URL is the same ALB. No de-duplication: CloudFront accepts multiple origins pointing at the same domain under distinct ids, and this keeps the locals graph dead simple. If a future consumer wants a shared origin between HTTP and gRPC behaviors, that's an additive change.
• compress is intentionally omitted on gRPC behaviors (provider default false); gRPC handles compression at the protocol layer.
• The new internal map key prefix __grpc__<path> exists only for for_each iteration; it never appears in any rendered AWS resource (the dynamic block emits origin.value.origin_id, not the key).

Verification

• terraform fmt -recursive aws-cf-reverse-proxy/ clean.
• terraform validate against aws-cf-reverse-proxy/tests/test1/ (AWS provider 6.44.0): clean both with the default test (grpc_routes unset) and with a sample entry {"/a2a.v1.A2AService/*" = "https://eks-alb.example.com"}.
• Back-compat for grpc_routes = {} is structurally guaranteed:
  • local.grpc_origin_configs = {}
  • local.all_origin_configs = merge(origin_configs, {}) == origin_configs
  • new dynamic "ordered_cache_behavior" iterates over {} -> zero blocks
  • http_version = length({}) > 0 ? "http2and3" : "http2" -> "http2"
• With one grpc_routes entry, plan would show: 1 added origin (origin-grpc-...), 1 added ordered_cache_behavior with grpc_config { enabled = true }, and http_version flipping http2 -> http2and3. No other in-place changes.

Follow-up

• Tag a new release after merge so ui-infrastructure can bump ?ref= and add a grpc_routes entry. The issue suggests v56.0.0; current latest tag is v55.15.2. Not cutting the tag here — leaving that to a maintainer.
• The ui-infrastructure consumer side is tracked in luthersystems/ui-infrastructure#241; chart side in insideoutmcp chart: add gRPC port + service.annotations passthrough mars#131.