[v1.37] policy: Deduplicate SecretWatchers and TLS Contexts

[fristonio]

Backport of #2006

[sayboras]

understand that it's still in draft, however, it's better to rebase with v1.37 latest branch, so that some of CI changes are included.

[jrajahalme]

The 2nd commit is not necessary, as Envoy 1.37 already has this dependency, albeit with a different name:

        "@com_github_google_benchmark//:benchmark",

The benchmark test failure is due to Envoy 1.37 not supporting running benchmarks from outside of the Envoy repo. IMO the best fix is to add a v1.37 specific patch to apply the upstream 1.38 fix (envoyproxy/envoy@bc6c805) for this as a preparatory commit to the backport commit:

diff --git a/WORKSPACE b/WORKSPACE
index 2a875bdbd..ead065ec6 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -45,6 +45,7 @@ git_repository(
         "@//patches:0006-test-integration-Defer-fake-upstream-read-enable-un.patch",
         "@//patches:0007-config-add-grpc-mux-stream-event-callback.patch",
         "@//patches:0008-repo-Make-yq-dependency-optional-for-CI-config-parsi.patch",
+        "@//patches:0009-test-use-bazel_tools-runfiles-to-locate-benchmark-bin.patch",
     ],
     # // clang-format off: Envoy's format check: Only repository_locations.bzl may contains URL references
     remote = "https://github.com/envoyproxy/envoy.git",
diff --git a/patches/0009-test-use-bazel_tools-runfiles-to-locate-benchmark-bin.patch b/patches/0009-test-use-bazel_tools-runfiles-to-locate-benchmark-bin.patch
new file mode 100644
index 000000000..c9a962df9
--- /dev/null
+++ b/patches/0009-test-use-bazel_tools-runfiles-to-locate-benchmark-bin.patch
@@ -0,0 +1,57 @@
+From bc6c8052f90b3eda7d7bb3c5387b22cd6d98c96d Mon Sep 17 00:00:00 2001
+From: Alex Bakon <abakon@netflix.com>
+Date: Wed, 14 Jan 2026 21:15:28 +0000
+Subject: [PATCH] test: use bazel_tools runfiles to locate benchmark bin
+
+Use the bazel_tools runfiles library for Bash to locate the benchmark
+binary to be run. The previous approach only worked for benchmarks
+defined in the Envoy repository, while this approach allows the macro to
+be used in projects that import Envoy as a dependency.
+
+Signed-off-by: Alex Bakon <abakon@netflix.com>
+---
+ bazel/envoy_test.bzl                 | 3 ++-
+ bazel/test_for_benchmark_wrapper.sh | 15 ++++++++++++++-
+ 2 files changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/bazel/envoy_test.bzl b/bazel/envoy_test.bzl
+--- a/bazel/envoy_test.bzl
++++ b/bazel/envoy_test.bzl
+@@ -309,9 +309,10 @@ def envoy_benchmark_test(
+     sh_test(
+         name = name,
+         srcs = [repository + "//bazel:test_for_benchmark_wrapper.sh"],
++        deps = ["@bazel_tools//tools/bash/runfiles"],
+         data = [":" + benchmark_binary] + data,
+         exec_properties = exec_properties,
+-        args = ["%s/%s" % (native.package_name(), benchmark_binary)],
++        args = ["$(rlocationpath %s)" % native.package_relative_label(benchmark_binary)],
+         tags = tags + ["nocoverage"],
+         **kargs
+     )
+diff --git a/bazel/test_for_benchmark_wrapper.sh b/bazel/test_for_benchmark_wrapper.sh
+--- a/bazel/test_for_benchmark_wrapper.sh
++++ b/bazel/test_for_benchmark_wrapper.sh
+@@ -1,6 +1,19 @@
+ #!/usr/bin/env bash
++#
++# Disable warnings about non-constant sources in runfiles.bash initialization.
++# shellcheck disable=SC1090
++
++# Copy-pasted from the Bazel Bash runfiles library v3.
++set -uo pipefail; set +e; f=bazel_tools/tools/bash/runfiles/runfiles.bash
++source "${RUNFILES_DIR:-/dev/null}/$f" 2>/dev/null || \
++  source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
++  source "$0.runfiles/$f" 2>/dev/null || \
++  source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
++  source "$(grep -sm1 "^$f " "$0.exe.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
++  { echo>&2 "ERROR: cannot find $f"; exit 1; }; f=; set -e
++# --- end runfiles.bash initialization v3 ---
+ 
+ # Set the benchmark time to 0 to just verify that the benchmark runs to
+ # completion.  We're interacting with two different flag parsers, so the order
+ # of flags and the -- matters.
+-"${TEST_SRCDIR}/envoy/${1}" "${@:2}" --skip_expensive_benchmarks -- --benchmark_min_time=0s
++$(rlocation "${1}") "${@:2}" --skip_expensive_benchmarks -- --benchmark_min_time=0s
+-- 
+2.43.0

The other CI flake (in tests/bpf_metadata_integration_test.cc:648) is fixed by #2007, both should be backported.