OIDC source type

[guicassolato]

Add OIDC source type to the AccessPolicy API.

E.g.:

apiVersion: agentic.networking.x-k8s.io/v1alpha1
kind: XAccessPolicy
spec:
  targetRefs: […]
  rules:
  - source:
      type: OIDC
      oidc:
        issuerUrl: auth-server.example.com

Proposed in: Dynamic Auth (0017)

Notes for the implementation

Modify the global injection of Envoy's JWT filter.

• Before: based always on the static issuer URL discovered from the cluster OIDC configuration

• After: Issuer URL overridden per-route whenever an OIDC-enabled AccessPolicy affects the route