Envoy's basic_auth filter defaults the WWW-Authenticate: Basic realm value to the full request URL

*Description*:
Envoy's basic_auth filter defaults the WWW-Authenticate: Basic realm="..." value to the full request URL (scheme+host+path) when no realm is configured. Since SecurityPolicy.spec.basicAuth (v1alpha1) only exposes users and forwardUsernameHeader — no realm field — every distinct path under a protected route gets a different realm.

Start by locating Envoy's basic_auth filter and the SecurityPolicy.spec.basicAuth handling described in the issue. Reproduce the WWW-Authenticate header on protected routes with different paths, then verify that an unconfigured realm no longer varies with the full request URL.

Written by the indexing model from the issue text.