Implementation for Istio ambient opt-in

[mjnagel]

Follow-on/implementation for #1247

Add/implement the ability to opt-in to ambient based on the outcome of the design doc. We should have at least one test workload that opts-into ambient in CI.

[mjnagel]

More details can/should be added based on the outcome of the design doc.

[mjnagel]

May be some initial implementations for this in #1142 and #699

[mjnagel]

This is temporarily on hold pending further review and decision of #1245.

Initial draft implementation was pushed up to branches:

• Draft work: Does not encompass the network policy side, supports multiple Package CRs in one namespace
• "Complete" work: Only allows/supports a single package in the namespace