Sending Cease/Hard Reset notification

[YutaroHayakawa]

Copying the commit message here:

Send Cease/Hard Reset notification for certain scenario when graceful
restart + notification support (RFC8538) are enabled. In this
implementation, we follow the suggestion of RFC8538 and map following
notification subcodes to Hard Reset subcode.

1. BGP_ERROR_SUB_MAXIMUM_NUMBER_OF_PREFIXES_REACHED

In this case, GoBGP is in the resource shortage and not working
properly. Thus, the peer should stop forwarding packet immediately.

2. BGP_ERROR_SUB_ADMINISTRATIVE_SHUTDOWN

This happens when the user uses DisablePeer API. This clearly indicates
user's intention of shutting down the session. Thus, we should send Hard
Reset.

3. BGP_ERROR_SUB_PEER_DECONFIGURED

This happens when the user uses DeletePeer API or StopBgp API or there's
an ASN mismatch found in the Open phase. The former two cases, the user
shows the intention to shutdown the session, so we should Hard Reset.
The latter case is not so obvious, but I think it's ok to do Hard Reset
because it is an unrecoverable error that cannot be solved without
user's involvement.

4. BGP_ERROR_SUB_HARD_RESET

This case currently doesn't exist, but obviously we should send Hard
Reset when someone explicitly specifies it.

The behavior for the remaining subcodes are unchanged. We may want to
expose a knob to adjust the behavior of BGP_ERROR_SUB_ADMINISTRATIVE_RESET
as suggested by RFC8538, but for this initial implementation, we kept it
as is.

Our use case for this is letting users of Cilium BGP Control Plane hard reset the session when they service out the node for maintenance. In the current GoBGP implementation, there's no way to perform a hard reset, so users must wait to shut down the node (shutdown the data plane on the node, in other words) until the graceful restart timer expires. Otherwise, it causes a traffic disruption.

One concern is that this is a breaking change for people who rely on any modified notification message to trigger a graceful restart procedure. I'm ok with hiding this feature behind a flag if it is harmful, but I guess the impact is limited because the document suggests sending SIGINT or SIGKILL to trigger graceful restart procedure. In those cases, GoBGP shutdown the session without any notification, so the procedure will be triggered anyways.

[fujita]

Thanks a lot!