feat: RequestAuthentication add required field to JWTRule (#60823)

[fjglira]

Adds an optional required boolean field to JWTRule in RequestAuthentication.

When required: true, the JWT for that rule must be present and valid. Requests without it are rejected with 401 Unauthorized, even if other JWT rules in the same policy are satisfied.

This enables workloads that must validate multiple JWT tokens from different issuers and headers (for example, an identity token in Authorization and a scope token in a custom header). Defaults to false

Issue reference: istio/istio#60823

Example

apiVersion: security.istio.io/v1
kind: RequestAuthentication
metadata:
  name: multi-jwt
spec:
  selector:
    matchLabels:
      app: my-service
  jwtRules:
  - issuer: "https://idp.example.com"
    jwksUri: "https://idp.example.com/.well-known/jwks.json"
    fromHeaders:
    - name: authorization
      prefix: "Bearer "
    required: true # New field
  - issuer: "https://scope.example.com"
    jwksUri: "https://scope.example.com/.well-known/jwks.json"
    fromHeaders:
    - name: x-scope-token
    required: true # New field

These changes require the implementation of the new feature in the istio/istio repo. I'll create the PR as draft and once this is reviewed and merged, I'll undraft the other one

[istio-policy-bot]

🤔 🐛 You appear to be fixing a bug in Go code, yet your PR doesn't include updates to any test files. Did you forget to add a test?

Courtesy of your friendly test nag.

[istio-policy-bot]

😊 Welcome @fjglira! This is either your first contribution to the Istio api repo, or it's been
a while since you've been here.

You can learn more about the Istio working groups, Code of Conduct, and contribution guidelines
by referring to Contributing to Istio.

Thanks for contributing!

Courtesy of your friendly welcome wagon.