feat(webhook): enforce per-runner dynamic labels policy in dispatcher

[edersonbrilhante]

Description

Adds an opt-in, per-matcher policy for dynamic EC2 override labels so operators
can declare which ghr-ec2-* keys/values each runner queue is allowed to honor.

The webhook lambda is the gatekeeper: when a workflow_job arrives, it picks the
first matching runner queue that both opts into dynamic labels
(matcherConfig.enableDynamicLabels) and accepts every ghr-ec2-* label on the
job per matcherConfig.ec2DynamicLabelsPolicy. If no queue qualifies, the
request is returned with 202 and a warning is logged instead of falling back to
a queue with the dynamic labels stripped.

Highlights:

• Adds a small EC2 dynamic labels policy evaluator co-located with dispatch.ts.
• Replaces the flat reserved-key schema with:
  { blocked_keys?, restricted_keys? }.
• blocked_keys rejects EC2 override keys outright.
• restricted_keys applies per-key value rules:
  { allowed?, denied?, max? }.
• EC2 override keys not listed in either blocked_keys or restricted_keys are
  allowed by default.
• The flag and policy travel inside the existing runner-matcher-config SSM
  parameter via MatcherConfig. No new SSM parameter or env var is added.
• Root single-runner config exposes ec2_dynamic_labels_policy; matcher config
  exposes ec2DynamicLabelsPolicy.

Example

multi_runner_config = {
  m5 = {
    matcherConfig = {
      labelMatchers           = [["self-hosted", "linux"]]
      exactMatch              = true
      enableDynamicLabels     = true
      ec2DynamicLabelsPolicy = {
        blocked_keys = ["image-id", "subnet-id"]

        restricted_keys = {
          "instance-type" = {
            allowed = ["m5.*"]
            denied  = ["m5.metal"]
          }

          "ebs-volume-size" = {
            max = 200
          }
        }
      }
    }

    runner_config = { ... }
  }
}

A job with ghr-ec2-instance-type:r5.large will be rejected with 202 and a
warning for the m5 queue rather than being silently dispatched without the
label.

Test Plan

• yarn exec vitest run functions/webhook/src/runners/dynamic-labels-policy.test.ts functions/webhook/src/runners/dispatch.test.ts
• terraform fmt -check -diff main.tf variables.tf modules/webhook/variables.tf modules/multi-runner/variables.tf

Related Issues

Fixes #5161
Fixes #5160

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[Brend-Smits]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Merge conflicts resolved in commit d60ec96.

Two files had conflicts:

1. lambdas/functions/control-plane/src/scale-runners/scale-up.ts — Combined our removal of the dynamicLabelsEnabled guard with main's per-group groupRunnerLabels accumulation fix (fix(scale-up): prevent runnerLabels accumulation across dynamic label groups #5176) and the shouldLoadLaunchTemplateBlockDeviceName/getDefaultBlockDeviceNameFromLaunchTemplate feature (feat: support dynamic EC2 placement and block device overrides #5178).

2. modules/multi-runner/README.md — Auto-generated doc conflict; took main's version as the base and inserted our enableDynamicLabels and ec2DynamicLabelsPolicy matcherConfig fields.

All 277 tests pass.

[edersonbrilhante]

@Brend-Smits I tested in my environment and it is working

[Brend-Smits]

Great work! Thanks a lot 🚀