policy: fix wildcarding at L7 for DNS
policy: fix wildcarding at L7 for DNS

Previously, if there was L7 policy applying to DNS at a specific port, (e.g.
port 53), for a specific selector (e.g., the selector representing the
"kube-system" namespace), and another rule which allowed all at L3 for the
"kube-system" namespace, the behavior which was expected is to allow *all* DNS
traffic at L7 on port 53, since the second rule allows all at L3 (which thus
allows all at L4, and at L7). However, the FQDNSelector which was being used to
synthesize allow-all at L7 was an empty selector (with no "MatchName" nor no
"MatchPattern" specified). This is treated by the DNS proxying code as allowing
*no* DNS requests at all, which is incorrect. So, when wildcarding at L7, be
sure to specify allow-all via " "matchPattern": "*" " in the synthesized
selector which is utilized by the DNS proxy.

Signed-off by: Ian Vernon <ian@cilium.io>

cilium/cilium,cilium-team/cilium,cilium/cilium,tgraf/cilium,cilium-team/cilium,cilium/cilium,cilium/cilium,michi-covalent/cilium,tgraf/cilium,michi-covalent/cilium,tklauser/cilium,tklauser/cilium,tgraf/cilium,michi-covalent/cilium,tklauser/cilium,tgraf/cilium,tgraf/cilium,tklauser/cilium,cilium/cilium,tgraf/cilium,michi-covalent/cilium,tklauser/cilium,michi-covalent/cilium