Add kubebuilder validations in proto for extauth AuthConfig

[arianaw66]

Description

This PR adds kubebuilder markers and CEL validation rules to the AuthConfig CRD.
These are unit tested thoroughly in https://github.com/solo-io/gloo-mesh-enterprise/pull/16951.
The constraints are notated here, primarily in the first two commits, which come from the solo-projects validation code and are therefore guaranteed to be constraints that apply when using Edge.

API changes

No API fields have been changed, but this adds pre-admission validation which can affect customers' pipelines. The changes proposed here should only affect AuthConfig CRs which are not currently ACCEPTED by our translation.

Docs changes

The docs will unfortunately be updated with the kubebuilder markers, as there's no way to hide the additional proto comments from the docs.
The docs team will also add user-facing constraint descriptions according to the notes here.

Context

This is motivation by the validation milestone in progress for Gloo Platform.

Interesting decisions

Further discussion of the relevant factors and decisions can be found on the ExtAuthPolicy validation issue that is a part of that milestone.

Testing steps

See https://github.com/solo-io/gloo-mesh-enterprise/pull/16951 for testing steps

Checklist:

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added tests that prove my fix is effective or that my feature works

[solo-changelog-bot]

Issues linked to changelog:
https://github.com/solo-io/gloo-mesh-enterprise/issues/16010

[htpvu]

Since this API change effects Gloo Edge users, has it been approved by the relevant stakeholders? I know Field has some concerns with enabling such validations by default, for which we've had discussions around building a toggle in CRDs to conditionally not render these validations.

I'd like to see a signoff from @sam-heilbron @DuncanDoyle and @kcbabo before this merges.

I've brought this change to the attention of @DuncanDoyle @kcbabo and @sam-heilbron, we have their thumbs up on the change and we can merge this PR right after the 1.17 branch is cut.

cc: @arianaw66

[arianaw66]

It appears the bump to solo-kit v0.35.1 breaks the build-bot tests
See #9626

[Rachael-Graham]

Approving for now. There's some followup doc work I'd like to do, which will include 1) translating rules into user-friendly comments, and 2) figuring out some way to update solo-kit so that the cel rules themselves dont build into the published docs.

[sheidkamp]

"Approved"

• Checked the rules against the CheckIfInvalidAuthConfig function
• Pulled changes into solo-projects and manually ran the in memory and kubernetes e2e ext-auth tests
• Ran ./projects/gloo/pkg/syncer/extauth validation unit tests