feat: support BackendCluster for Remote JWKS

[zhaohuabing]

This PR introduces support for representing JWT remote JWKS as Backend resources. With this enhancement, users can:

• Specify a self-signed CA: use BackendTLSPolicy to define a self-signed CA for the remote JWKS
• Configure retry policies: use rmoteJWKS.backendSettings.retry to sepecify the retry policy for the remote JWKS

Implements: #3536
Release Notes: Yes

[codecov]

Codecov Report

Attention: Patch coverage is 76.33136% with 40 lines in your changes missing coverage. Please review.

Project coverage is 66.80%. Comparing base (8b89dad) to head (4cbf407).

Files with missing lines	Patch %	Lines
internal/gatewayapi/securitypolicy.go	78.94%	19 Missing and 9 partials ⚠️
internal/xds/translator/jwt.go	66.66%	8 Missing and 4 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5011      +/-   ##
==========================================
- Coverage   66.84%   66.80%   -0.04%     
==========================================
  Files         211      210       -1     
  Lines       32916    32943      +27     
==========================================
+ Hits        22004    22009       +5     
- Misses       9586     9598      +12     
- Partials     1326     1336      +10     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[zhaohuabing]

SecuritcyPolicy validation has been moved from the xds translation to the API translation. This change allows validation errors to be caught earlier and reflected in the SecurityPolicy status.

[zhaohuabing]

Remove this empty spec check because other policy types don't do this check. We can apply the check to all the policy types through CEL in a follow-up PR if it's needed.

[zhaohuabing]

This file was deleted from the API package and the validations have been moved into the gatewapi translator.

[StephenRobin]

@zhaohuabing Thank you for working on this! It's been blocking us from adopting Envoy Gateway and I'm looking forward to seeing this merged.

I notice this PR doesn't update the documentation, it would be good to see an example added there. Also for using OIDC with an internal certificate, it took me a couple of hours to work out how to do that.

[arkodg]

LGTM thanks !

[zhaohuabing]

@StephenRobin

I notice this PR doesn't update the documentation, it would be good to see an example added there.

Will update the docs in a follow-up PR.

Also for using OIDC with an internal certificate, it took me a couple of hours to work out how to do that.

You can find an example for OIDC here: https://gateway.envoyproxy.io/docs/tasks/security/oidc/#connect-to-an-oidc-provider-with-self-signed-certificate