chore(helm): Fix setting X-Scope-OrgID header for ws

[bcskda]

What this PR does / why we need it: helm nginx config: fix setting X-Scope-OrgID from basic auth for websocket endpoints

Which issue(s) this PR fixes: probably related #9756

Special notes for your reviewer:

Current production/helm/loki chart includes the gateway component (nginx proxy). In multi-tenant mode with auth_enabled it uses HTTP basic auth to determine the tenant (by username). After authentication it sets the X-Scope-OrgID header with proxy_set_header directive in http{} scope.

Per proxy_set_header documentation:

These directives are inherited from the previous configuration level if and only if there are no proxy_set_header directives defined on the current level

, which is the case: the nested location{} blocks for websocket endpoints use the directive to enable websocket connection upgrade. So, in nested locations the http block-scoped proxy_set_header directive is ignored.

This leads to two issues:

1. Valid requests to websocket endpoints that include valid basic auth don't get the X-Scope-OrgID header populated, which leads to 401 errors, as observed earlier in the linked issue;
2. Requests by tenant X that include their valid basic auth may include client-provided X-Scope-OrgID header that is neither sanitized nor overriden by proxy_set_header, which might allow tenant X to access another tenant's logs in some configurations.

Checklist

• Reviewed the CONTRIBUTING.md guide (required)
• Documentation added
• Tests updated
• Title matches the required conventional commits format, see here
  • Note that Promtail is considered to be feature complete, and future development for logs collection will be in Grafana Alloy. As such, feat PRs are unlikely to be accepted unless a case can be made for the feature actually being a bug fix to existing behavior.
• Changes that require user attention or interaction to upgrade are documented in docs/sources/setup/upgrade/_index.md
• If the change is deprecating or removing a configuration option, update the deprecated-config.yaml and deleted-config.yaml files respectively in the tools/deprecated-config-checker directory. Example PR

[CLAassistant]

All committers have signed the CLA.

[cyriltovena]

LGTM