Add support for specifying `targetRef` namespace on authorization policies

**Describe the feature request**

When using the k8s gateway API (with Istio as a gateway controller), I'd like to be able to store authorization policies alongside applications, alongside HTTPRoutes and similar application-specific resources.

Today, it looks like the only way to target application-specific resources with AuthorizationPolicies when using the gateway API is to target the entire gateway, and then use a rule to filter the policy based on hosts/paths/etc. that match the application's HTTPRoute. While not ideal, this should in theory work.

However, because the AuthorizationPolicy does not support targeting gateways in other namespaces, the policy must live in either the default namespace (so it'll match gateways in all namespaces), or the gateway's namespace. This means moving application-specific resources away from the application, and away from all other related ingress configuration.

I'd like to be able to specify the namespace for the referenced gateway within the authorization policy so that I can place the policy in application namespaces, instead of gateway namespaces. It looks like work was already started on this [here](https://github.com/istio/api/pull/2888), but never completed.

**Describe alternatives you've considered**

Store the resource in the gateway namespace

**Affected product area (please put an X in all that apply)**

[ ] Configuration Infrastructure
[ ] Docs
[ ] Installation
[x] Networking
[ ] Performance and Scalability
[x] Policies and Telemetry
[x] Security
[ ] Test and Release
[ ] User Experience

**Additional context**