Update docker.io/openpolicyagent/opa Docker tag to v0.67.1

[renovate]

This PR contains the following updates:

Package	Update	Change
docker.io/openpolicyagent/opa	minor	0.66.0-debug -> 0.67.1-debug

---

Release Notes

open-policy-agent/opa (docker.io/openpolicyagent/opa)

v0.67.1

Compare Source

This is a bug fix release addressing the following issue:

• util+server: Fix bug around chunked request handling (#​6906) authored by @​philipaconrad, reported by @​David-Wobrock. A request handling bug was introduced in (#​6868), which caused OPA to treat all incoming chunked requests as if they had zero-length request bodies.

v0.67.0

Compare Source

This release contains a mix of features, a new builtin function (strings.count), performance improvements, and bugfixes.

Breaking Change

Request Body Size Limits

OPA now automatically rejects very large requests (#​6868) authored by @​philipaconrad.
Requests with a Content-Length larger than 128 MB uncompressed, and gzipped requests with payloads that decompress to
larger than 256 MB will be rejected, as part of hardening OPA against denial-of-service attacks. Previously, a large
enough request could cause an OPA instance to run out of memory in low-memory sidecar deployment scenarios, just from
attempting to read the request body into memory.

These changes allow improvements in memory usage for the OPA HTTP server, and help OPA deployments avoid some accidental out-of-memory situations.

For most users, no changes will be needed to continue using OPA. However, to control this behavior, two new configuration
keys are available: server.decoding.max_length and server.decoding.gzip.max_length. These control the max size in
bytes to allow for an incoming request payload, and the maximum size in bytes to allow for a decompressed gzip request payload, respectively.

Here's an example OPA configuration using the new keys:

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.