MINOR: filters: add if/unless ACL condition support to filter directives

This patch adds support for optional "if <condition>" and "unless <condition>"
clauses on the "filter" configuration directive. This allows filters to be
conditionally activated at runtime based on ACL expressions, similar to how
http-request/http-response rules support conditions.

When a condition is specified, it is evaluated at two points in the filter
dispatch chain:
  - flt_post_analyze(): before calling channel_post_analyze callbacks
  - flt_analyze_http_headers(): before calling http_headers callbacks

If the condition evaluates to false, the filter's callbacks are skipped
entirely for that stream, meaning the filter will not register as a data
filter and will not process any payload data.

When no condition is specified (cond is NULL), acl_match_cond() returns 1,
so existing filter configurations without if/unless continue to work
unchanged.

Example usage:
  # conditionally enable compression offload per host via map
  filter compression if { hdr(host),map(/opt/haproxy/etc/extension.map) on }
  compression offload
  compression algo gzip
  compression type text/html text/plain

---
diff --git a/include/haproxy/filters-t.h b/include/haproxy/filters-t.h
index 6c1879f..a0e01fc 100644
--- a/include/haproxy/filters-t.h
+++ b/include/haproxy/filters-t.h
@@ -41,6 +41,7 @@ struct http_msg;
 struct proxy;
 struct stream;
 struct channel;
+struct acl_cond;
 struct flt_conf;
 struct filter;
 
@@ -212,6 +213,7 @@ struct flt_conf {
 	void           *conf; /* The filter configuration */
 	struct list     list; /* Next filter for the same proxy */
 	unsigned int    flags; /* FLT_CFG_FL_* */
+	struct acl_cond *cond; /* optional if/unless condition */
 };
 
 /*
diff --git a/src/filters.c b/src/filters.c
index 3b0662b..7da8041 100644
--- a/src/filters.c
+++ b/src/filters.c
@@ -11,6 +11,7 @@
  */
 
 #include <haproxy/api.h>
+#include <haproxy/acl.h>
 #include <haproxy/buf-t.h>
 #include <haproxy/cfgparse.h>
 #include <haproxy/compression.h>
@@ -258,9 +259,19 @@ parse_filter(char **args, int section_type, struct proxy *curpx,
 			goto error;
 		}
 		if (*args[cur_arg]) {
-			memprintf(err, "'%s %s' : unknown keyword '%s'.",
-			          args[0], args[1], args[cur_arg]);
-			goto error;
+			if (strcmp(args[cur_arg], "if") == 0 || strcmp(args[cur_arg], "unless") == 0) {
+				fconf->cond = build_acl_cond(file, line, &curpx->acl,
+				                             curpx, (const char **)args + cur_arg, err);
+				if (!fconf->cond) {
+					memprintf(err, "'%s %s' : %s",
+					          args[0], args[1], err && *err ? *err : "invalid condition");
+					goto error;
+				}
+			} else {
+				memprintf(err, "'%s %s' : unknown keyword '%s'.",
+				          args[0], args[1], args[cur_arg]);
+				goto error;
+			}
 		}
 		if (fconf->ops == NULL) {
 			memprintf(err, "'%s %s' : no callbacks defined.",
@@ -273,7 +284,10 @@ parse_filter(char **args, int section_type, struct proxy *curpx,
 	return 0;
 
   error:
-	free(fconf);
+	if (fconf) {
+		free_acl_cond(fconf->cond);
+		free(fconf);
+	}
 	return -1;
 
 
@@ -388,6 +402,7 @@ flt_deinit(struct proxy *proxy)
 		if (fconf->ops->deinit)
 			fconf->ops->deinit(proxy, fconf);
 		LIST_DELETE(&fconf->list);
+		free_acl_cond(fconf->cond);
 		free(fconf);
 	}
 }
@@ -846,6 +861,11 @@ flt_post_analyze(struct stream *s, struct channel *chn, unsigned int an_bit)
 
 	list_for_each_entry(filter, &strm_flt(s)->filters, list) {
 		if (FLT_OPS(filter)->channel_post_analyze &&  (filter->post_analyzers & an_bit)) {
+			if (!acl_match_cond(filter->config->cond, s->be, s->sess, s,
+			                    ((chn->flags & CF_ISRESP) ? SMP_OPT_DIR_RES : SMP_OPT_DIR_REQ) | SMP_OPT_FINAL)) {
+				filter->post_analyzers &= ~an_bit;
+				continue;
+			}
 			DBG_TRACE_DEVEL(FLT_ID(filter), STRM_EV_FLT_ANA, s);
 			filter->calls++;
 			ret = FLT_OPS(filter)->channel_post_analyze(s, filter, chn, an_bit);
@@ -878,6 +898,9 @@ flt_analyze_http_headers(struct stream *s, struct channel *chn, unsigned int an_
 
 	RESUME_FILTER_LOOP(s, chn) {
 		if (FLT_OPS(filter)->http_headers) {
+			if (!acl_match_cond(filter->config->cond, s->be, s->sess, s,
+			                    ((chn->flags & CF_ISRESP) ? SMP_OPT_DIR_RES : SMP_OPT_DIR_REQ) | SMP_OPT_FINAL))
+				continue;
 			DBG_TRACE_DEVEL(FLT_ID(filter), STRM_EV_HTTP_ANA|STRM_EV_FLT_ANA, s);
 			filter->calls++;
 			ret = FLT_OPS(filter)->http_headers(s, filter, msg);