feat: added trusted hosts necessary for istio ambient

[sgettys]

Description

adds trusted host for istio ambient with ztunnel (".pepr-uds-core-watcher.pepr-system.svc.cluster.local") and istio ambient with waypoint (".keycloak.svc.cluster.local")

Ambient traffic with only ztunnel will show as coming from the pepr pod directly since it only does L4 routing and connects directly to the Keycloak pod. Ambient traffic when Waypoint is deployed for Keycloak shows as originating from the Keycloak Waypoint proxy.

Related Issue

Fixes #

Relates to #

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Other (security config, docs update, etc)

Checklist before merging

• Test, docs, adr added or updated as needed
• Contributor Guide Steps(https://github.com/defenseunicorns/uds-template-capability/blob/main/CONTRIBUTING.md#submitting-a-pull-request) followed

[UnicornChance]

LGTM

[mjnagel]

I think this makes sense and shouldn't hurt anything, but we may need to try and find a way to do this on an upgrade (the realm is only imported at install), potentially with Terraform + manual upgrade docs (two options). That could be a follow on PR if we want though.

[UnicornChance]

That's a good call i didn't consider @mjnagel. This is where we've been documenting upgrade steps that require manual intervention, if we go that route.