[7] feat: configure cloud service mesh for the federated learning use case

[ferrarimarco]

Configure Cloud Service Mesh for the federated learning use case:

• Enable the core platform gke_enterprise/servicemesh service
• Move Policy Controller constraints definitions in their own directory under common
• Create Cloud Service Mesh configuration files in common/servicemesh
  • Configure mesh-wide defaults
  • Configure service entries for Private Google Access and the GKE Metadata server
  • Configure the egress gateway
• Configure tenant-specific authorization policies to only allow traffic within the tenant namespace

Core platform enhancements:

• Configure the mesh block in google_gke_hub_feature_membership.cluster_servicemesh to match the fleet_default_member_config.mesh block in google_gke_hub_feature.servicemesh to avoid unnecessary diffs.

Notes:

• Destroy doesn't complete because of dangling NEGs and related resources left over by Cloud Service Mesh. The current workaround is to open a support ticket as explained at the bottom of this page: https://cloud.google.com/service-mesh/docs/uninstall
• Gateway pods aren't schedulable until GKE Core platform updates and enhancements #82 is merged.