[RFC] Add WebAssembly (Proxy-WASM) Dynamic Filter Subsystem (pingora-wasm)

Summary

My propose introducing an opt-in WebAssembly filter runtime crate (pingora-wasm) to enable dynamic, hot-loadable proxy extensions for Pingora without needing to recompile or restart proxy binaries.

Motivation

Proxies in modern cloud-native environments (e.g., Envoy) rely heavily on WebAssembly (Proxy-WASM) for dynamic security, auth, and header-mutation plugins. Providing native Wasm host support in Pingora will:

1. Allow developers to write proxy filters in Rust, Go, C++, or Zig and deploy them on the fly.
2. Maintain Pingora's high-performance characteristics using a sandboxed wasmtime JIT engine.
3. Bring enterprise-grade dynamic plugin extensibility to the Pingora ecosystem.

Proposed Architecture

• Crate: pingora-wasm (workspace module under pingora/)
• Runtime Engine: wasmtime (JIT-compiled Wasm engine)
• Interface: Binds Pingora's ProxyHttp lifecycle callbacks (request_filter, response_filter) to Wasm guest modules via standard Proxy-WASM ABI host functions.

Prototype Status

I have built an initial prototype crate (pingora-wasm) compiled and verified against Pingora's current workspace.

I would love to gather feedback from Cloudflare maintainers regarding:

1. Preferred module location (pingora-wasm crate vs optional feature flag under pingora-proxy).
2. Any specific ABI or runtime constraints preferred by the team.

Looking forward to your thoughts and guidance before opening the Pull Request!