SecurityPolicy (strategicmerge) Composition does not work

*Description*:
What I want to aeheive is the following:

1. Setup OIDC Authentication at the Gateway Level
2. Setup Authorization at the Route Level

Here the example:

```
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
name: oidc
spec:
targetRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: gateway
oidc:
provider:
issuer: https://login.microsoftonline.com/-/v2.0
clientID: -
clientSecret:
name: envoy-client-secret
forwardAccessToken: false
redirectURL: https://oidc.example.com/oauth2/callback
cookieDomain: example.com
cookieNames:
accessToken: EnvoyAccessToken
idToken: EnvoyIdToken
jwt:
providers:
- name: entra
issuer: https://login.microsoftonline.com/-/v2.0
remoteJWKS:
uri: https://login.microsoftonline.com/-/discovery/v2.0/keys
extractFrom:
cookies:
- EnvoyIdToken
```

```
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
name: argocd
spec:
mergeType: StrategicMerge
targetRefs:
- group: gateway.networking.k8s.io
kind: HTTPRoute
name: argocd
authorization:
defaultAction: Deny
rules:
- name: "allow-jwt-claim"
action: Allow
principal:
jwt:
provider: entra
claims:
- name: roles
valueType: "StringArray"
values:
- "argocd"
```

I assume that a the end the resulting security policy should be

```
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
name: argocd
spec:
mergeType: StrategicMerge
targetRefs:
- group: gateway.networking.k8s.io
kind: HTTPRoute
name: argocd
authorization:
defaultAction: Deny
rules:
- name: "allow-jwt-claim"
action: Allow
principal:
jwt:
provider: entra
claims:
- name: roles
valueType: "StringArray"
values:
- "argocd"
oidc:
provider:
issuer: https://login.microsoftonline.com/-/v2.0
clientID: -
clientSecret:
name: envoy-client-secret
forwardAccessToken: false
redirectURL: https://oidc.example.com/oauth2/callback
cookieDomain: example.com
cookieNames:
accessToken: EnvoyAccessToken
idToken: EnvoyIdToken
jwt:
providers:
- name: entra
issuer: https://login.microsoftonline.com/-/v2.0
remoteJWKS:
uri: https://login.microsoftonline.com/-/discovery/v2.0/keys
extractFrom:
cookies:
- EnvoyIdToken
```

However it's not working.

Start by applying the two SecurityPolicy manifests from the issue and compare the generated configuration with the expected merged policy. Trace strategic-merge composition for the Gateway-level OIDC policy and HTTPRoute-level authorization policy; done means both OIDC and JWT authorization settings are preserved and effective together.

Written by the indexing model from the issue text.