Support the from field in CUSTOM action AuthorizationPolicy rules.

Currently, when using action: CUSTOM in an AuthorizationPolicy, the from field (source matching) is ignored. This makes it impossible to restrict which sources trigger the external authorizer — it gets invoked on every request to the workload regardless of origin.

This is explicitly noted as a TODO in the Istio source: https://github.com/istio/istio/blob/bbcc281448b246e16e4502b93053de1a69dea559/pkg/config/validation/validation.go#L1438

Describe alternatives you've considered

Splitting traffic by path using a VirtualService as a workaround — internal callers are routed to a separate path prefix that does not match the CUSTOM policy, while external callers use the original path. This adds operational complexity and a non-semantic path convention (/v1/internal/...) that leaks implementation details into the API surface.

Affected product area (please put an X in all that apply)

[ ] Ambient [ ] Docs [ ] Dual Stack [ ] Installation [ ] Networking [ ] Performance and Scalability [ ] Extensions and Telemetry [X] Security [ ] Test and Release [ ] User Experience [ ] Developer Infrastructure

Affected features (please put an X in all that apply)

[ ] Multi Cluster [ ] Virtual Machine [ ] Multi Control Plane

Additional context

A common use case is a service that acts both as a public API endpoint and as a backend-for-frontend (BFF). External traffic should be validated by a custom authorizer (e.g. a token validator), while internal mesh traffic from a UI already carries a valid identity and should not be sent to the external authorizer. Without "from" support in CUSTOM policies, there is no clean way to express this distinction.

Another old issue related to this is https://github.com/istio/istio/issues/41335