feat(dp-token): allow validator to define keys not scoped to a mesh

[nicoche]

This permits dpServer.authn.dpPRoxy.dpToken.validator.publicKeys to omit the .mesh field. Keys without the .mesh field will be considered to verify the signature of dataplane tokens, no matter the mesh of the dataplane.

Checklist prior to review

• Link to relevant issue https://kuma-mesh.slack.com/archives/CN2GN4HE1/p1698324155036599 --
• This will not break child repos: it doesn't hardcode values (.e.g "kumahq" as a image registry) and it will work on Windows, system specific functions like syscall.Mkfifo have equivalent implementation on the other OS --
• Tests (Unit test, E2E tests, manual test on universal and k8s) --
• Do you need to update UPGRADE.md? --
• Does it need to be backported according to the backporting policy? (this GH action will add "backport" label based on these file globs, if you want to prevent it from adding the "backport" label use no-backport-autolabel label) --

[jakubdyszkiewicz]

Nice!

Could you also add E2E test for it?
We could improve test/e2e_env/universal/auth/offline_auth.go:13

• generate another sample key here test/keys/README.md
• add a new entry in cpConfig#dpServer.authn.dpProxy.validator.publicKeys in test
• add another It( (or change to DescribeTable if you want) with the new key

This way we can validate this functionality and also check if we can combine meshed and not meshed keys.

Let me know if you need help

[nicoche]

Great! Honestly, I did not know where to look for, regarding the tests. I'll add that

[nicoche]

Should be good now, the e2e tests pass locally 🙂