feat: RequestAuthentication add presence field to JWTRule (#60823)

[fjglira]

Adds a presence field of type JWTRequirement to JWTRule in RequestAuthentication.

When presence: REQUIRED, the JWT for that rule must be present and valid. Requests without it are rejected with 401 Unauthorized, even if other JWT rules in the same policy are satisfied.

This enables workloads that must validate multiple JWT tokens from different issuers and headers (for example, an identity token in Authorization and a scope token in a custom header). Defaults to OPTIONAL.

Issue reference: istio/istio#60823

Example

apiVersion: security.istio.io/v1
kind: RequestAuthentication
metadata:
  name: multi-jwt
spec:
  selector:
    matchLabels:
      app: my-service
  jwtRules:
  - issuer: "https://idp.example.com"
    jwksUri: "https://idp.example.com/.well-known/jwks.json"
    fromHeaders:
    - name: authorization
      prefix: "Bearer "
    presence: REQUIRED
  - issuer: "https://scope.example.com"
    jwksUri: "https://scope.example.com/.well-known/jwks.json"
    fromHeaders:
    - name: x-scope-token
    presence: REQUIRED

These changes require the implementation of the new feature in the istio/istio repo. I'll create the PR as draft and once this is reviewed and merged, I'll undraft the other one

[istio-policy-bot]

😊 Welcome @fjglira! This is either your first contribution to the Istio api repo, or it's been
a while since you've been here.

You can learn more about the Istio working groups, Code of Conduct, and contribution guidelines
by referring to Contributing to Istio.

Thanks for contributing!

Courtesy of your friendly welcome wagon.