Wire AllowedAudiences from AgentRuntime CRD to AuthProxy sidecar

[akram]

Summary

kagenti-extensions#356 added AllowedAudiences support in the AuthProxy sidecar, including the aud[] array parsing fix. However, there is currently no way to configure AllowedAudiences declaratively via the AgentRuntime CR — the operator doesn't know about this field yet.

This issue tracks the work to expose AllowedAudiences through the operator so that it can be set via the CRD and passed to the AuthProxy sidecar configuration.

What needs to happen

1. Add an allowedAudiences field to the AgentRuntime CRD spec (e.g. under spec.auth)
2. Wire that field through the operator's reconciliation logic so it gets passed to the AuthProxy sidecar configuration

Context

• AllowedAudiences is considered a transitional/bridge mechanism until the auth model is finalized (see discussion thread)
• Related bug issue: kagenti-extensions#406 — AuthProxy should support the aud[] claim included in inbound JWT
• Without this operator change, there is no declarative way for users to configure which audiences the AuthProxy should accept, which blocks the application-to-agent flow

References

• PR with the AuthProxy-side implementation: feat: Support AllowedAudiences for inbound JWT validation cortex#356