MADR for Inbound policies

[lobkovilya]

Description

Today applying policies on the inbound is possible only with "from" section of the policies, but it has some limitations:

• impossible to configure inbound ports differently on the same proxy
• no support for MeshExternalService
• impossible to create and configure routes on the inbounds
• selecting a group of client for configuration is always based on a group of proxies (i.e. no support for MeshExternalClient or ServiceAccount)

[lobkovilya]

xref:

• Design from policies with spec.targetRef selecting whole proxies #11078
• Hard limit on BuildRules output #5028
• spec.targetRef.proxyTypes validation #8930
• MES + Egress:
  • Support some policies for ZoneIngress/ZoneEgress #8417
  • Implement MeshTrace for MeshExternalServices #9049
  • Add support for targeting ZoneEgress in MeshFaultInjection #10722
  • MeshRateLimit should be able to configure for MeshExternalService with Egress #10723
  • Support for a MeshExternalService targeting in MeshTrafficPermission #10868
  • AutoReachable services with MeshExternalService #11077
• MeshAccessLog support per-route configuration #6645
• MeshTLS doesn't set TLS version on delegated gateway #12107