Add proto for authentication policy.

[diemtvu]

Initial API for Authentication policy. In this version, the policy is able to:

• Independently config peer (service-to-service) and end-user authentication.
• Allow to use JWT for peer authentication though still need follow up implementation.
• Allow to use multiple JWTs simultaneously.

The policy has not yet include 'impersonation' rules, and other options to conditionally activate authentication mechanism (e.g enable/disable a particular end-user auth based on peer identity).

Example specs for use cases:

1. Turn on mTLS for all service-to-service, and (end-user) JWT for service productpage (will need 2 policies)

metadata:
  name: global
spec:
  destinations:  # leave blank for all.
  peers:
  - mTLS:

and

metadata
  name: productpage
spec:
  destinations:
  - name: productpage
    port: 9000
  peers:
  - mTLS:
  endUsers:
  - jwt:
      issuer: "https://securetoken.google.com"
      jwksUri: "https://www.googleapis.com/oauth2/v1/certs"

Using either mTLS or JWT for service-to-service

metadata:
  name: global
spec:
  destinations:  # leave blank for all.
  peers:
  - mTLS:
  - jwt:
      issuer: "https://securetoken.istio.io"

Design doc link

[diemtvu]

This is redo of #335, due to some git merge mess up.