[Request] Documentation on usage with istio // other service mesh

### Describe the feature

I would like to see in documentation/guide a setup for istio in both scenarios:
1. cryostat being part of istio mesh
1. requirements/setup for Cryostat JMX connection to work with target running inside istio mesh
2. requirements/setup for Cryostat JMX connection to work with target running outside istio mesh
3. requirement/setup for cryostat agent connection to cryostat (I guess connections is other way around in that scenario) which JMV being inside the mesh
4. requirement/setup for cryostat agent connection to cryostat (I guess connections is other way around in that scenario) which JMV being outside the mesh
2. cryostat being outside of istio mesh
1. requirements/setup for Cryostat JMX connection to work with target running inside istio mesh
2. equirement/setup for cryostat agent connection to cryostat (I guess connections is other way around in that scenario) which JMV being inside the mesh

### Anything other information?

I can get kind of way round with 2.i. with
```yaml
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
name: name
namespace: namespace
spec:
mtls:
mode: PERMISSIVE
selector:
matchLabels:
app: {{ .Values.apps.service.name }}
```
but it is allowing all connections to target one, which is not desired.

I am experimenting with
```yaml
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
name: name
namespace: namespace
spec:
mtls:
mode: UNSET
portLevelMtls:
"9091":
mode: PERMISSIVE
selector:
matchLabels:
app: {{ .Values.apps.service.name }}
```
but it is not working, not sure if this is because JMX specific thing or some lack of istio configuration

Start in documentation/guide and review the requested Istio scenarios, including Cryostat JMX and agent connections for targets inside and outside the mesh. Use the PeerAuthentication examples and port 9091 details in the issue as the starting configuration. Done means the guide covers each listed topology and documents a least-permissive setup rather than allowing all target connections.

Written by the indexing model from the issue text.