fix(secret): aws secret manager fails when the secret name contains a slash

[nic-6443]

Description

AWS Secrets Manager allows slashes in secret names, but apisix/secret/aws.lua splits the key at the first slash. For $secret://aws/1/john/secret/john-key-auth where the secret is actually named john/secret, APISIX sends SecretId=john and treats secret/john-key-auth as the JSON field name, so the lookup fails with ResourceNotFoundException (vault.lua, by contrast, splits at the last slash).

The reference URI is inherently ambiguous — there is no way to know upfront where the secret name ends and the JSON field begins. This PR resolves it with a longest-name-first fallback: first try the whole remaining key as the SecretId with no field, and on ResourceNotFoundException progressively move path segments from the right into the field position, e.g. for john/secret/john-key-auth:

1. SecretId=john/secret/john-key-auth (no field)
2. SecretId=john/secret, field john-key-auth
3. SecretId=john, field secret/john-key-auth

The first successful lookup wins. A definitive non-NotFound error (e.g. auth failure, connection error) aborts immediately instead of trying more splits. Keys without slashes behave exactly as before, and since apisix/secret.lua caches resolved values by URI in an lrucache, the extra requests only happen on cache miss.

Precedence note: the old behavior always split at the first slash. If both interpretations exist (a secret literally named john containing the field secret/john-key-auth and a secret named john/secret), the longest matching secret name now takes precedence. This rule is documented in the secret terminology doc (en + zh).

#11655 attempted to fix this earlier but went stale; this PR picks the issue up with the fallback-resolution approach and adds regression tests (slash-named secret with field lookup, full key as secret name, end-to-end $secret:// URI resolution), with the corresponding secrets seeded into the localstack used by CI.

Which issue(s) this PR fixes:

Fixes #11647

Checklist

• I have explained the need for this PR and the problem it solves
• I have explained the changes or the new features added to this PR
• I have added tests corresponding to this change
• I have updated the documentation to reflect this change
• I have verified that this change is backward compatible (see the precedence note above for the only behavioral edge case)

[Copilot]

Pull request overview

This PR fixes AWS Secrets Manager lookups when secret names contain / by changing APISIX’s $secret://aws/... resolution to try the longest possible secret name first and progressively shift trailing path segments into the JSON field portion only on ResourceNotFoundException. It also adds regression tests, updates documentation to describe the precedence rule, and seeds additional test secrets into the CI localstack environment.

Changes:

• Update apisix/secret/aws.lua to implement longest-name-first fallback splitting (right-to-left) on NotFound.
• Add tests covering slash-containing secret names, “full key is the secret name” behavior, and end-to-end $secret://aws/... resolution.
• Document the new precedence rule in EN/ZH terminology docs and seed corresponding secrets in CI localstack.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
apisix/secret/aws.lua	Implements fallback lookup logic for slash-containing secret names by shifting segments from right to field name on NotFound.
t/secret/aws.t	Adds regression tests for slash-named secrets, full-path secret names, and $secret:// URI resolution.
ci/init-common-test-service.sh	Seeds new localstack secrets used by the new tests.
docs/en/latest/terminology/secret.md	Documents the new AWS slash-name precedence/lookup behavior.
docs/zh/latest/terminology/secret.md	Same documentation update in Chinese.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.