Introduce flags for disabling Workload and SDS APIs

[matheuscscp]

Part of: #7116

Introduces service-level switches in SPIRE Agent for disabling APIs that are normally served on the public agent endpoint:

• agent.disable_workload_api / -disableWorkloadAPI
• agent.disable_sds_api / -disableSDSAPI

The public endpoint remains enabled while at least one of those APIs is enabled:

• disable_workload_api = false, disable_sds_api = false: expose both Workload API and SDS
• disable_workload_api = true, disable_sds_api = false: expose only SDS
• disable_workload_api = false, disable_sds_api = true: expose only Workload API
• disable_workload_api = true, disable_sds_api = true: do not bind the public endpoint

This applies uniformly to the Unix socket configured by agent.socket_path and the Windows named pipe configured by agent.experimental.named_pipe_name. Existing configurations keep the current behavior because both flags default to false.

This is useful for deploying Broker API-only agents.

[Copilot]

Pull request overview

This PR makes the SPIRE Agent Workload API (and SDS endpoint) optional by allowing the configured Workload API listen address to be disabled (via socket_path = "" on POSIX or experimental.named_pipe_name = "" on Windows). This supports running an agent in “Broker API over TCP only” deployments without binding the Workload API socket/pipe, while preserving existing defaults when the fields are omitted.

Changes:

• Gate agent endpoint startup/health semantics on agent.Config.BindAddress being non-nil (nil disables Workload API + SDS).
• Update agent CLI/config parsing to distinguish “unset” vs “explicitly empty” for socket_path and named_pipe_name (using *string and a custom optional string flag).
• Add tests and update docs + reference config to document disabling behavior and related broker socket-path directory rules.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
pkg/agent/config.go	Documents BindAddress nil as disabling Workload API + SDS.
pkg/agent/agent.go	Skips workload/SDS endpoint task when BindAddress is nil; adjusts health behavior accordingly.
pkg/agent/agent_test.go	Adds coverage for CheckHealth() when Workload API is disabled.
cmd/spire-agent/cli/run/run.go	Switches socket_path/named_pipe_name to *string, adds merge helpers and an optional string flag type.
cmd/spire-agent/cli/run/run_posix.go	Implements POSIX socket_path enable/disable logic and relaxes directory constraints when Workload API is disabled.
cmd/spire-agent/cli/run/run_windows.go	Implements Windows named_pipe_name enable/disable logic and relaxes validation for empty socket_path.
cmd/spire-agent/cli/run/run_posix_test.go	Adds/updates tests for explicit empty socket_path and downstream config behavior.
cmd/spire-agent/cli/run/run_windows_test.go	Adds/updates tests for explicit empty named_pipe_name and downstream config behavior.
doc/spire_agent.md	Documents disabling Workload API/SDS via empty socket/pipe; clarifies broker socket-path restriction behavior.
conf/agent/agent_full.conf	Updates reference config comments to describe disabling behavior.

[amartinezfayo]

Thank you @matheuscscp!

[matheuscscp]

@amartinezfayo I addressed everything in 3bd8c53

As a follow-up from this PR, I realized we need to add the Broker Endpoints to the healthchecks as well, especially since we are preparing the SPIRE agent to run only with Broker API.