Expose AuthContext to policy executionCondition CEL expressions

Description

Policy executionCondition CEL expressions currently cannot inspect the authentication result from earlier auth policies. This forces policy authors to propagate auth state through the shared Metadata map as a workaround, instead of using the typed AuthContext already populated by auth policies (jwtValidation, apiKey, basicAuth, MCP OAuth, etc.).

The CEL environment in gateway/gateway-runtime/policy-engine/internal/pkg/cel/evaluator.go (createCELEnv) registers only processing.phase, request.*, and response.* variables. SharedContext.AuthContext (sdk/core/policy/v1alpha2/context.go) — which carries Authenticated, Authorized, AuthType, Subject, Issuer, Audience, Scopes, CredentialID, Properties, and the Previous chain — is never added to the CEL eval map by any build*EvalCtx helper.

As a result, common conditions like "skip this policy if a prior auth layer already authenticated the request" cannot be expressed directly. For example, an author wants to write:

auth.Authenticated == true && 'admin' in auth.Scopes

…but today must instead have the auth policy write ctx.Metadata["auth.authenticated"] = true and check request.Metadata['auth.authenticated'] == true.

Proposed change:

1. In createCELEnv(), register an auth object plus flattened variables:
   • auth.Authenticated (bool)
   • auth.Authorized (bool)
   • auth.AuthType (string)
   • auth.Subject (string)
   • auth.Issuer (string)
   • auth.Audience (list)
   • auth.Scopes (map<string, bool>)
   • auth.CredentialID (string)
   • auth.Properties (map<string, string>)
2. In each buildRequestHeaderEvalCtx, buildRequestBodyEvalCtx, buildResponseHeaderEvalCtx, buildResponseBodyEvalCtx, buildStreamingRequestEvalCtx, buildStreamingResponseEvalCtx, populate the auth keys from ctx.SharedContext.AuthContext, defaulting to a zero-value object when AuthContext is nil (so expressions like auth.Authenticated == false evaluate safely before any auth policy has run).
3. Add unit tests in internal/pkg/cel/evaluator_test.go covering nil and populated AuthContext.
4. Document the new variables in the policy / API.yaml specification.

Version

No response

Related Issue

No response

Start with gateway/gateway-runtime/policy-engine/internal/pkg/cel/evaluator.go, especially createCELEnv and the six named build*EvalCtx helpers, then review sdk/core/policy/v1alpha2/context.go and run internal/pkg/cel/evaluator_test.go. Done means nil and populated AuthContext cases are covered, the auth variables work across each evaluation context, and the new variables are documented in the policy / API.yaml specification.