[mbelur]

add native Istio ext_authz ingress-auth mode (default) with single-sourced gateway identity

In short: enforce "are you logged in?" at the ingress gateway using standard Istio instead of a fragile custom EnvoyFilter that could silently fail open, and keep the gateway's identity in one place.

Replace the self-contained EnvoyFilter as the default ingress-gateway authentication with upstream-parity native Istio ext_authz, selectable via global.oauth2Proxy.gatewayAuthMode (native | envoyfilter), and consolidate the gateway identity into one place so Rancher<->upstream Istio is a single flip.

Why:

• The legacy EnvoyFilter relies on Envoy >=1.17 features; on older proxies istiod NACKs the filter and auth can fail open. Native ext_authz has no such floor and matches kubeflow/community-distribution, easing support.
• Gateway selector/principal were duplicated across four subcharts and could drift; they now have a single source of truth.

What:

• Native mode: RequestAuthentication (dex-jwt) + CUSTOM ext_authz and require-jwt DENY AuthorizationPolicies on the ingress gateway (kubeflow-istio-resources).
• Legacy mode retained for BYO/managed Istio via -f values-envoyfilter-authz.yaml or runMe.sh --legacy-authz; the two modes are mutually exclusive.
• istio-native-authz-values.yaml registers the oauth2-proxy MeshConfig extensionProvider (wired into the Istio install by runMe.sh by default).
• native-authz-guard fails the install fast if that provider is missing, to prevent a silent deny-all-ingress lockout (inert during template/dry-run).
• Single-source global.istio.ingressGateway.{principal,selector} consumed by kubeflow-istio-resources, kubeflow-hub, user-namespace, and knative-serving via nil-safe helpers; removes per-chart istioGateway/ingressGatewayPrincipal. validations.yaml fails fast if an override still sets a removed key, pointing to the new global location (schema does not forbid unknown keys).
• oauth2-proxy skip_auth_routes ^/dex/ is single-sourced in the base configFile under a native-only conditional (the chart tpl-renders configFile); the envoyfilter overlay just flips gatewayAuthMode.
• dex-jwt issuer/jwksUri hardcode the kubeflow namespace to match every other dex reference and avoid an iss-mismatch lockout.
• Tests: smoke asserts exactly one auth mode is live + the extensionProvider is registered; e2e adds a gateway deny-path check (dual-mode, host-aware).
• Docs: README "Ingress gateway authentication mode" section, the kubeflow release-name/namespace requirement, and troubleshooting updates.

Known limitation: in native mode the require-jwt DENY selects the shared ingress gateway workload, so cookie-less external KServe inference on that gateway is denied; KServe in-cluster traffic (dedicated local gateway) is unaffected.