telemetry: add tracing

- telemetry/tace: add traces throughout code
- telemetry/metrics: nest metrics and trace under telemetry
- telemetry/tace: add service name span to HTTPMetricsHandler.
- telemetry/metrics: removed chain dependency middleware_tests.
- telemetry/metrics: wrap and encapsulate variatic view registration.
- telemetry/tace: add jaeger support for tracing.
- cmd/pomerium: move `parseOptions` to internal/config.
- cmd/pomerium: offload server handling to httputil and sub pkgs.
- httputil: standardize creation/shutdown of http listeners.
- httputil: prefer curve X25519 to P256 when negotiating TLS.
- fileutil: use standardized Getw

Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>

authenticate/grpc.go

@@ -6,11 +6,14 @@ import (
 	"fmt"
 
 	"github.com/pomerium/pomerium/internal/sessions"
+	"github.com/pomerium/pomerium/internal/telemetry/trace"
 	pb "github.com/pomerium/pomerium/proto/authenticate"
 )
 
 // Authenticate takes an encrypted code, and returns the authentication result.
 func (p *Authenticate) Authenticate(ctx context.Context, in *pb.AuthenticateRequest) (*pb.Session, error) {
+	_, span := trace.StartSpan(ctx, "authenticate.grpc.Validate")
+	defer span.End()
 	session, err := sessions.UnmarshalSession(in.Code, p.cipher)
 	if err != nil {
 		return nil, fmt.Errorf("authenticate/grpc: authenticate %v", err)
@@ -25,6 +28,9 @@ func (p *Authenticate) Authenticate(ctx context.Context, in *pb.AuthenticateRequ
 // Validate locally validates a JWT id_token; does NOT do nonce or revokation validation.
 // https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation
 func (p *Authenticate) Validate(ctx context.Context, in *pb.ValidateRequest) (*pb.ValidateReply, error) {
+	ctx, span := trace.StartSpan(ctx, "authenticate.grpc.Validate")
+	defer span.End()
+
 	isValid, err := p.provider.Validate(ctx, in.IdToken)
 	if err != nil {
 		return &pb.ValidateReply{IsValid: false}, fmt.Errorf("authenticate/grpc: validate %v", err)
@@ -35,10 +41,8 @@ func (p *Authenticate) Validate(ctx context.Context, in *pb.ValidateRequest) (*p
 // Refresh renews a user's session checks if the session has been revoked using an access token
 // without reprompting the user.
 func (p *Authenticate) Refresh(ctx context.Context, in *pb.Session) (*pb.Session, error) {
-	// todo(bdd): add request id from incoming context
-	// md, _ := metadata.FromIncomingContext(ctx)
-	// sublogger := log.With().Str("req_id", md.Get("req_id")[0]).WithContext(ctx)
-	// sublogger.Info().Msg("tracing sucks!")
+	ctx, span := trace.StartSpan(ctx, "authenticate.grpc.Refresh")
+	defer span.End()
 	if in == nil {
 		return nil, fmt.Errorf("authenticate/grpc: session cannot be nil")
 	}