Add trustDomains and notTrustDomains to AuthzPolicy source

[ymesika]

This PR introduces trustDomains and notTrustDomains fields to the AuthorizationPolicy Source rule.
This allows users to accurately and safely match against the identity's trust domain without resorting to potentially error-prone glob-style matching on the full principal URI.

This proposal is fully backward compatible. The addition of optional fields will not impact existing AuthorizationPolicy resources that do not use the new trustDomains fields.

Example:

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: allow-some-trust-domains
  namespace: default
spec:
  action: ALLOW
  rules:
  - from:
    - source:
        trustDomains: ["cluster1.local", "cluster2.local"]

Or:

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: allow-all-but-specific
  namespace: default
spec:
  action: ALLOW
  rules:
  - from:
    - source:
        notTrustDomains: ["not.trust.domain"]

[istio-policy-bot]

😊 Welcome @ymesika! This is either your first contribution to the Istio api repo, or it's been
a while since you've been here.

You can learn more about the Istio working groups, Code of Conduct, and contribution guidelines
by referring to Contributing to Istio.

Thanks for contributing!

Courtesy of your friendly welcome wagon.