CEL authz type

[guicassolato]

Add CEL authorization type to the AccessPolicy API.

E.g.:

apiVersion: agentic.networking.x-k8s.io/v1alpha1
kind: XAccessPolicy
spec:
  targetRefs: […]
  rules:
  - authorization:
    - type: CEL
      cel: 'mcp.tool_name.startsWith("verify_")'

Proposed in: Dynamic Auth (0017)

Notes for the implementation

Options for the implementation to investigate:

1. CEL-enabled RBAC filter's condition field: https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/rbac/v3/rbac.proto#config-rbac-v3-policy

2. Golang filter: https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/golang_filter#config-http-filters-golang

3. Dynamic modules: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/dynamic_modules/v3/dynamic_modules.proto#envoy-v3-api-msg-extensions-dynamic-modules-v3-dynamicmoduleconfig