[Nexthop][fboss2-dev] Add fboss2-dev config acl CLI subcommands

[benoit-nexthop]

Summary

Adds two new subcommands under config acl for configuring ACL table groups and tables:

• config acl table-group <group-name> stage <stage-value> — sets AclTableGroup.stage (enum: ingress, ingress-macsec, egress-macsec, ingress-post-lookup, or numeric 0–3)
• config acl table <group-name> <table-name> priority <value> — sets AclTable.priority (non-negative i16)

The Thrift model has a two-level key structure (AclTableGroup → AclTable). Both commands target sw.aclTableGroups (field 56, the preferred form); the deprecated aclTableGroup (field 45) is not supported.

When FLAGS_enable_acl_table_group is set, both changes are applied at runtime via processAclTableGroupDelta in SaiSwitch with no warmboot-prohibited guard, so the CLI marks them HITLESS. When that flag is off (the default on some platforms today), aclTableGroups changes take a different code path in SaiSwitch; this PR only adds the CLI plumbing and was validated against a DUT with the flag off, so the flag-on runtime path is not covered by the included tests (see Test Plan).

Group/table lookup logic shared between the two subcommand handlers lives in AclConfigUtils.{h,cpp} rather than being duplicated between the table and table-group handlers.

Test Plan

Unit tests (19/19 passing)

The seed config includes two table groups (the first with two tables), so tests can assert that mutating the targeted group/table leaves its siblings untouched, and dedicated tests target the non-first group/table by name — with only one group/table, or only ever mutating index 0, a find_if bug that matched "first element" instead of "match by name" would pass undetected. A separate fixture with no aclTableGroups at all covers the "no aclTableGroups configured" error branch shared by both handlers.

./fboss/oss/scripts/bazel.sh test //fboss/cli/fboss2/test/config:cmd_config_test \
    --test_filter='CmdConfigAcl*' --test_output=all

[ RUN      ] CmdConfigAclTableGroupTestFixture.argValidation_valid                    OK
[ RUN      ] CmdConfigAclTableGroupTestFixture.argValidation_badArity                 OK
[ RUN      ] CmdConfigAclTableGroupTestFixture.argValidation_unknownAttr              OK
[ RUN      ] CmdConfigAclTableGroupTestFixture.argValidation_invalidStage             OK
[ RUN      ] CmdConfigAclTableGroupTestFixture.setStageIngressPostLookup              OK
[ RUN      ] CmdConfigAclTableGroupTestFixture.setStageNoopSameValue                  OK
[ RUN      ] CmdConfigAclTableGroupTestFixture.setStageOnNonFirstGroup                OK
[ RUN      ] CmdConfigAclTableGroupTestFixture.groupNotFound                          OK
[ RUN      ] CmdConfigAclNoGroupsTestFixture.tableGroupNoAclTableGroupsConfigured     OK
[ RUN      ] CmdConfigAclTableTestFixture.argValidation_valid                         OK
[ RUN      ] CmdConfigAclTableTestFixture.argValidation_badArity                      OK
[ RUN      ] CmdConfigAclTableTestFixture.argValidation_unknownAttr                   OK
[ RUN      ] CmdConfigAclTableTestFixture.argValidation_nonInteger                    OK
[ RUN      ] CmdConfigAclTableTestFixture.argValidation_negative                      OK
[ RUN      ] CmdConfigAclTableTestFixture.setPriority                                 OK
[ RUN      ] CmdConfigAclTableTestFixture.setPriorityOnNonFirstTable                  OK
[ RUN      ] CmdConfigAclTableTestFixture.tableNotFound                              OK
[ RUN      ] CmdConfigAclTableTestFixture.groupNotFound                               OK
[ RUN      ] CmdConfigAclNoGroupsTestFixture.tableNoAclTableGroupsConfigured          OK
[  PASSED  ] 19 tests.

Integration tests (NH-4010-F — skipped: DUT has no sw.aclTableGroups)

The NH-4010-F DUT used for testing uses a single flat ACL map without ACL table groups (FLAGS_enable_acl_table_group is off / field 56 absent). The integration tests detect this and skip gracefully:

[ SKIPPED ] ConfigAclTest.SetTableGroupStage — DUT has no sw.aclTableGroups (field 56)
[ SKIPPED ] ConfigAclTest.SetTablePriority   — DUT has no sw.aclTableGroups (field 56)

Sample CLI transcript (NH-4010-F)

$ fboss2-dev config acl --help
Configure ACL table group and table settings
Subcommands:
  table                 Configure an ACL table within a group (e.g. set priority)
  table-group           Configure an ACL table group (e.g. set stage)

$ fboss2-dev config acl table-group --help
Positionals:
  acl_table_group_config TEXT x 3 REQUIRED
    <group-name> stage <stage-value> where <stage-value> is one of:
    ingress, ingress-macsec, egress-macsec, ingress-post-lookup (or numeric 0-3)

$ fboss2-dev config acl table --help
Positionals:
  acl_table_config TEXT x 4 REQUIRED
    <group-name> <table-name> priority <value>

$ fboss2-dev config acl
localhost: Thrift call failed: 'Incomplete command, please use 'table-group' or 'table' subcommand'

[joseph5wu]

Let's support create if not exist for both acl table group and acl table

[joseph5wu]

Can we consider to create a new acl table group if it doesn't exist?

[joseph5wu]

I wouldn't recommend to use Numeric fallback cause they're not straightforward.
Let's just enforce the string values as the only options

[joseph5wu]

Let's also support create an acl table if it doesn't exist