Carrying actor JWTs to an Egress PEP - use cases

With atunnel + pluggable egress support coming along, we would need atunnel to be able to use the actor identities**.

With the actor identities available for atunnel, atunnel will use the actor cert to initiate an mtls connection (with CONNECT) to the egress PEP. The question is whats the importance of the JWT to be carried over as well.

In my mind there are a few possible areas where this _could_ be useful;

1. JWTs will be forwarded to the final destination for authn -- however this brings the question of "what system is going to understand substrate JWTs and what to do with them?"

2. Egress PEP is going to do authn on behalf of the destination with the JWT-- for this I am (a) not sure how common is it and what will be the flow and (b) why a cert would not be enough?

For 2 I am likely missing good usecases or have limited understanding where/why this can be useful so feedback is mostly welcomed.

\** ActorIdentity Service work (to replace SessionIdentity) is in the works, and actor identities will be made available via atelet, an on a projected volume. TBD how the identities will get to ateom(atunnel), (possibly via UDS..?)

/cc @howardjohn @bowei @thockin @ahmedtd