broker Failed to authenticate HTTP request: Invalid signature

**Describe the bug**
A clear and concise description of what the bug is.

broker集群和proxy配置Kerberos，客户端使用client/xxx keytab直接访问broker没有问题，通过proxy访问不能返回正确结果，客户端使用proxy的keytab直接访问broker没有问题

具体环境如下：
Broker 10.2.177.39
Proxy 10.2.177.48

1.1)Broker_jaas.conf
PulsarBroker {
keyTab="/opt/brokers/conf/broker_10.2.177.39.keytab"
principal="broker/10.2.177.39@EXAMPLE.COM";
};

PulsarClient {
keyTab="/opt/brokers/conf/client_10.2.177.39.keytab"
principal="client/10.2.177.39@EXAMPLE.COM";
};
1.2)Broker.conf
clusterName=pulsar-cluster
proxyRoles=proxy
authenticateOriginalAuthData=true
authenticationEnabled=true
authenticationProviders=org.apache.pulsar.broker.authentication.AuthenticationProviderSasl
authorizationEnabled=true
authorizationProvider=org.apache.pulsar.broker.authorization.PulsarAuthorizationProvider
authorizationAllowWildcardsMatching=true
superUserRoles=proxy,client
brokerClientAuthenticationPlugin=org.apache.pulsar.client.impl.auth.AuthenticationSasl
brokerClientAuthenticationParameters={"saslJaasClientSectionName":"PulsarClient", "serverType":"broker"}
saslJaasClientAllowedIds=.*[a-zA-Z].*
saslJaasBrokerSectionName=PulsarBroker

1.3)proxy_jaas.conf
PulsarProxy {
keyTab="/opt/proxys/conf/proxy_10.2.177.48.keytab"
principal="proxy/10.2.177.48@EXAMPLE.COM";
};

PulsarClient {
keyTab="/opt/proxys/conf/client_10.2.177.48.keytab"
principal="client/10.2.177.48@EXAMPLE.COM";
};
1.4)proxy.conf
brokerServiceURL=pulsar://10.2.177.39:6650/
brokerWebServiceURL=http://10.2.177.39:8080/
superUserRoles=client,proxy
authorizationEnabled=true
authorizationProvider=org.apache.pulsar.broker.authorization.PulsarAuthorizationProvider
authenticationEnabled=true
authenticationProviders=org.apache.pulsar.broker.authentication.AuthenticationProviderSasl
anonymousUserRole=
saslJaasClientAllowedIds=.*client.*
saslJaasBrokerSectionName=PulsarProxy
brokerClientAuthenticationPlugin=org.apache.pulsar.client.impl.auth.AuthenticationSasl
brokerClientAuthenticationParameters={"saslJaasClientSectionName":"PulsarProxy", "serverType":"broker"}
clusterName=pulsar-cluster

1.5)client.conf
webServiceUrl=http://10.2.177.48:8080/
brokerServiceUrl=pulsar://10.2.177.48:6650/
authPlugin=org.apache.pulsar.client.impl.auth.AuthenticationSasl
authParams={"saslJaasClientSectionName":"PulsarClient", "serverType":"proxy"}

客户端执行命令
bin/pulsar-admin clusters list 返回HTTP 401 Unauthorized
broker日志报错WARN org.apache.pulsar.broker.web.AuthenticationFilter - [10.2.177.48] Failed to authenticate HTTP request: Invalid signature

broker中修改superUserRoles=proxy/10.2.177.48@EXAMPLE.COM,client/10.2.177.48@EXAMPLE.COM也会报相同错误，我想知道我是缺少什么配置或者哪里配置错误了嘛

Reproduce the failure with `bin/pulsar-admin clusters list` through the configured proxy, using the shown `client.conf`, `proxy.conf`, and broker settings. Start with the broker's `AuthenticationFilter` and compare the proxy-to-broker authentication configuration. Done means the request no longer returns HTTP 401 and the broker log no longer reports an invalid signature.

Written by the indexing model from the issue text.