Forward kcb_identity header to ucache backend from mcrouter

Summary:
When KCB is enabled, mcrouter rebuilds the upstream thrift request from a fixed set of carbon fields and drops any transport header it does not explicitly capture. On the non-lookaside path it stored the verified identity into `client_identifier` (only for shadow) and never populated `kcbIdentity_`, so mcrouter never re-emitted the `kcb_identity` header to the ucache backend. As a result `KeyClientBinder::getObfuscatedClientIdFromKcbIdentityHeader` was unreachable for proxied traffic and the `ucache.kcb_identity_header_*` counters stayed flat.

This forwards the client's `kcb_identity` header verbatim (via new `detail::rawKcbIdentityHeader`) whenever it is non-empty, inside the existing `enableKeyClientBinding_` guard. The vouching CAT is already forwarded alongside it, so the backend performs the authoritative `MEMCACHE_ID` check itself.

Reviewed By: lenar-f

Differential Revision: D111756121

fbshipit-source-id: 8f36cb6c35818c06bac5d6b75c989a288fd01a49

Author: Jay Ghurye

mcrouter/ServerOnRequest.h

@@ -84,6 +84,23 @@ inline std::optional<std::string> nonLookasideKcbIdentity(
   }
   return std::nullopt;
 }
+
+// Returns the `kcb_identity` header value iff present and non-empty. No CAT
+// verification -- verbatim passthrough, leaving the check to the backend.
+inline std::optional<std::string> rawKcbIdentityHeader(
+    const apache::thrift::Cpp2RequestContext& ctx) {
+  const auto* header = ctx.getHeader();
+  if (!header) {
+    return std::nullopt;
+  }
+  const auto& headers = header->getHeaders();
+  const auto it =
+      headers.find(std::string(carbon::MessageCommon::kKcbIdentityHeader));
+  if (it == headers.end() || it->second.empty()) {
+    return std::nullopt;
+  }
+  return it->second;
+}
 } // namespace detail
 #endif
 
@@ -278,6 +295,13 @@ class ServerOnRequest {
       if (serializedCat.has_value()) {
         reqRef.setCryptoAuthToken(std::string{serializedCat.value()});
       }
+
+      // Forward the client's `kcb_identity` header verbatim; the branches above
+      // only set `client_identifier`, so the backend's non-lookaside path needs
+      // this to see the header at all. The vouching CAT is forwarded above.
+      if (auto rawKcbIdentity = detail::rawKcbIdentityHeader(*thriftCtx)) {
+        reqRef.setKcbIdentity(*rawKcbIdentity);
+      }
     }
 #endif