Extend AuthorizationPolicy targetRef to TLSRoute

@zaharidichev is already working on this.

Since Apr 24, 2026.

### What problem are you trying to solve?

We added an EgressNetwork to block pods in a namespace to make requests outside the cluster. We need to add some exceptions, which can be done via a TLSRoute. But when doing so, all pods in the namespace can access this TLSRoute. I have tried adding a MeshTLSAuthentication and a AuthorizationPolicy linking the MeshTLSAuthentication to the TLSRoute, but TLSRoute is not a supported TargetRef.

### How should the problem be solved?

TLSRoute is in the standard gateway api (since version 1.5) and no loger considerd alpha. Is it possible to have TLSRoute as an extra TargetRef in the AuthorizationPolicy and thus adding EgressNetwork exceptions based on specific workloads instead of the whole namespace?

### Any alternatives you've considered?

Only option is the use namespace wide exceptions, giving other pods in the same namesapce also egress access.

### How would users interact with this feature?

People can interact with it via the targetRef spec of the AuthorizationPolicy:
```yaml
apiVersion: policy.linkerd.io/v1alpha1
kind: AuthorizationPolicy
metadata:
name: allow-x-to-y
namespace: ns-x
spec:
targetRef:
group: policy.linkerd.io
kind: TLSRoute
name: tls-y
requiredAuthenticationRefs:
- kind: MeshTLSAuthentication
name: pod-x
group: policy.linkerd.io
```

### Would you like to work on this feature?

maybe