[WIP] Add InboundTrafficPolicy and compression APIs - #3795

Inbound HTTP response compression currently requires EnvoyFilter configuration. This adds the experimental networking.istio.io/v1alpha1.InboundTrafficPolicy API with workload/resource targeting, ordered gzip/brotli/zstd compressors, port overrides, and structured per-target status. It also adds the explicit DestinationRule opt-in at trafficPolicy.compression.response.decompress.enabled, including subset and port-level policies.

Port overrides replace the top-level settings without inheritance. Their list limit matches DestinationRule at 4,096 entries, without a duplicate-port CEL rule. Empty inbound compression settings disable compression. Compressor lists are currently bounded at 64 entries.

Includes generated Go bindings, CRD schemas, reference documentation, release notes, and validation/serialization tests. This is an API-only draft: runtime policy resolution, Envoy configuration, status reconciliation, and downstream integration are follow-up work.

Design: Inbound Traffic Policy & Compression.

Validation:

• Go tests in the root and tests modules; the revised schema passes with 4,096 ports and 64 compressors per port.
• Protobuf lint, Go/YAML/copyright lint, and git diff --check.
• Protobuf compatibility against the updated master branch.
• Full generation and reproducibility checked; regenerated again after matching DestinationRule's port limit.
• Direct import checks passed for existing API packages. The repository import script emits an existing warning for the absent authentication directory.