feat(policies): Per policy enforced labels

[salvacorts]

What this PR does / why we need it:

Adds per-policy label enforcement. Enforced labels can only be declared via YAML as:

policy_enforced_labels:
   finance: ["taxregion", "agent"]
   staging: ["experimentid"]

The distributor enforces the labels resulted from compining policy_enforced_labels and the global enforced_labels.

Checklist

• Reviewed the CONTRIBUTING.md guide (required)
• Documentation added
• Tests updated
• Title matches the required conventional commits format, see here
  • Note that Promtail is considered to be feature complete, and future development for logs collection will be in Grafana Alloy. As such, feat PRs are unlikely to be accepted unless a case can be made for the feature actually being a bug fix to existing behavior.
• Changes that require user attention or interaction to upgrade are documented in docs/sources/setup/upgrade/_index.md
• If the change is deprecating or removing a configuration option, update the deprecated-config.yaml and deleted-config.yaml files respectively in the tools/deprecated-config-checker directory. Example PR

[github-actions]

💻 Deploy preview available: https://deploy-preview-loki-16182-zb444pucvq-vp.a.run.app/docs/loki/latest/

[DylanGuedes]

great work 🎉

do you think it might make sense to add a validation that warns if a policy_enforced_label is configured for some policy that doesn't have a mapping configured yet?

[salvacorts]

do you think it might make sense to add a validation that warns if a policy_enforced_label is configured for some policy that doesn't have a mapping configured yet?

I think that may actually be expected 🤔 a break glass procedure for a customer with a misbehaving policy may be to remove the mappings for that policy but leave the rest of the policy config as is.

Even if we wanna have that, I'd do it on a followup PR as we likely want it for the per policy blocked ingestion.