[Feature] App Routing Gateway API - Support Entra AD Auth

**Is your feature request related to a problem? Please describe.**
We use AKS, with various open source apps deployed as pods that don't have built in auth support, so we need to layer on auth as part of ingress.
Previously we've used nginx-ingress, using oauth-proxy for authentication via the nginx.ingress.kubernetes.io/auth-url / global-auth-url annotation.
The ask is to have a supported way to do this using application routing add-on for AKS (Istio).

**Describe the solution you'd like**
We would like the App Routing add-on to expose an officially supported mechanism to register external authorizers at the Gateway API ingress layer. This could be achieved in a couple of ways:

ConfigMap Schema Expansion: Update the istio-gateway-class-defaults ConfigMap allow-list to permit the declaration of an Envoy extensionProvider and basic routing hooks.

First-class Gateway API/Extension Support: Provide a managed annotation or a native integration method that maps to the underlying Envoy ext_authz filter so requests can be checked against a custom oauth2-proxy endpoint before being forwarded to backends.

(Even better would be true native Entra AD support - without needing oauth-proxy)

**Describe alternatives you've considered**
we've considered using alternative ingress (e.g. traefic) - and this is our backup plan. - but we would prefer to use a AKS managed service if possible.
We've also considered fill istio service mesh, but this is overkill for our use case (small, ~ 5 node AKS cluster used for data science tasks).
We've also considered the App Gateway Loadbalancer route - but also overkill for minimal clusters.