appsec: upgrade libddwaf v1.20.1 & ruleset v1.13.2

[eliottness]

What does this PR do?

This PR does multiple things following the upgrade to the latest release of libddwaf https://github.com/DataDog/libddwaf/releases/tag/1.20.1

• Upgrade libddwaf v1.19.0 -> v1.20.1
• Upgrade appsec static ruleset v1.13.0 -> v1.13.2
• Modify how addresses are passed following libddwaf v1.20.0 which made some addresses optional for fingerprinting

Motivation

• Better RASP detection via the new ruleset and WAF update

Reviewer's Checklist

• Changed code has unit tests for its functionality at or near 100% coverage.
• System-Tests covering this feature have been added and enabled with the va.b.c-dev version tag.
• There is a benchmark for any new code, or changes to existing code.
• If this interacts with the agent in a new way, a system test has been added.
• Add an appropriate team label so this PR gets put in the right place for the release notes.
• Non-trivial go.mod changes, e.g. adding new modules, are reviewed by @DataDog/dd-trace-go-guild.

Unsure? Have a question? Request a review!

[RomainMuller]

This means WithCookies(notNil) followed by WithCookies(nil) will leave the old cookies value around...

That feels like a pretty theoretical issue... but I guess if this is the intended behavior it should probably be documented at least?

[eliottness]

Actually this is the behavior for a lot of other optional addresses managed by the address builder. I had to temporarily change it otherwise fingerprints would not generate when there was no cookies in the request but the original goal is still the same: if the map is empty then there nothing for the WAF to run on, so we don't keep nil values. We could also try to delete the previous key in this case but this looks a bit overengineered considering the builder is a short-lived value.

[eliottness]

I don't mind adding docs on the WafAddressesBuilder type tho

[pr-commenter]

Benchmarks

Benchmark execution time: 2024-10-30 09:58:29

Comparing candidate commit b448bf6 in PR branch eliott.bouhana/rasp-ga with baseline commit fcda5e2 in branch main.

Found 0 performance improvements and 3 performance regressions! Performance is the same for 56 metrics, 0 unstable metrics.

scenario:BenchmarkOTelApiWithCustomTags/datadog_otel_api-24

• 🟥 execution_time [+124.702ns; +178.098ns] or [+2.604%; +3.719%]

scenario:BenchmarkOTelApiWithCustomTags/otel_api-24

• 🟥 execution_time [+220.365ns; +286.835ns] or [+3.043%; +3.961%]

scenario:BenchmarkStartSpanConcurrent-24

• 🟥 execution_time [+148.925ns; +327.275ns] or [+2.742%; +6.026%]