fix(kuma-cp): guard the nil version in metadata

[jakubdyszkiewicz]

Summary

Guard the nil version.dependencies.

I went through code a couple of times and it seems that the only place where we can get a nil panic.

Issues resolved

Fix #3968

Documentation

No docs.

Testing

• Unit tests
• E2E tests
• Manual testing on Universal
• Manual testing on Kubernetes

Backwards compatibility

- [ ] Update UPGRADE.md with any steps users will need to take when upgrading.

• Add backport-to-stable label if the code follows our backporting policy

[lahabana]

We have pentest coming soon these are the kind of bugs we'll find!

[lahabana]

+1 for backporting

[lahabana]

Shouldn't the http endpoint catch panics btw?

[codecov-commenter]

Codecov Report

Merging #3969 (87ad464) into master (c1d2350) will increase coverage by 0.01%.
The diff coverage is 0.00%.

@@            Coverage Diff             @@
##           master    #3969      +/-   ##
==========================================
+ Coverage   56.02%   56.03%   +0.01%     
==========================================
  Files         917      917              
  Lines       54770    54771       +1     
==========================================
+ Hits        30684    30691       +7     
+ Misses      21640    21633       -7     
- Partials     2446     2447       +1     

Impacted Files	Coverage Δ
pkg/core/xds/metadata.go	62.35% <0.00%> (+6.40%)	⬆️
pkg/core/tokens/default_signing_key.go	72.22% <0.00%> (-8.34%)	⬇️
pkg/kds/reconcile/reconciler.go	79.48% <0.00%> (-5.13%)	⬇️
pkg/core/secrets/manager/global_manager.go	39.39% <0.00%> (-3.04%)	⬇️
pkg/plugins/resources/postgres/store.go	74.68% <0.00%> (-0.43%)	⬇️
api/mesh/v1alpha1/dataplane_insight.pb.go	44.84% <0.00%> (+0.25%)	⬆️
pkg/defaults/components.go	88.88% <0.00%> (+3.70%)	⬆️
pkg/plugins/runtime/gateway/route/sorter.go	71.79% <0.00%> (+5.12%)	⬆️
pkg/core/resources/manager/cache.go	88.31% <0.00%> (+5.19%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update c1d2350...87ad464. Read the comment docs.

[jakubdyszkiewicz]

Shouldn't the http endpoint catch panics btw?

Good question. It seems that the regular http package does recover from panic. I just checked it.
also golang/go#25245

But grpc code is different. Maybe we can also recover there somehow

edit: there is a way https://github.com/grpc-ecosystem/go-grpc-middleware let me do this in the follow up PR