feat: add configurable mTLS identity extraction with fallback chain (#3640)

Add support for configurable identity attributes in mTLS authentication,
allowing identity extraction from CommonName, Subject DN, Email SAN,
URI SAN, or DNSName SAN with fallback chain support. Includes regex
pattern matching for URI SANs (e.g., SPIFFE workload IDs).

- Add MTLSConfig with identity attributes, URISANPattern, and index fields
- Implement extractMTLSIdentity with fallback chain logic
- Move the mtls tests in the api package to pkg/api/mtls_test.go

Signed-off-by: Andrei Aaron <andreifdaaron@gmail.com>

errors/errors.go

@@ -186,4 +186,14 @@ var (
 	ErrInvalidEventSinkType             = errors.New("invalid sink type")
 	ErrEventSinkAddressEmpty            = errors.New("address field cannot be empty")
 	ErrCouldNotCreateHTTPEventTransport = errors.New("default transport is not *http.Transport")
+	ErrNoIdentityInCommonName           = errors.New("no identity found in CommonName")
+	ErrNoURISANFound                    = errors.New("no URI SAN found")
+	ErrURISANIndexOutOfRange            = errors.New("URI SAN index out of range")
+	ErrURISANPatternDidNotMatch         = errors.New("URI SAN pattern did not match")
+	ErrInvalidURISANPattern             = errors.New("invalid URI SAN pattern")
+	ErrNoDNSANFound                     = errors.New("no DNS SAN found")
+	ErrDNSANIndexOutOfRange             = errors.New("DNS SAN index out of range")
+	ErrNoEmailSANFound                  = errors.New("no Email SAN found")
+	ErrEmailSANIndexOutOfRange          = errors.New("Email SAN index out of range")
+	ErrUnsupportedIdentityAttribute     = errors.New("unsupported identity attribute")
 )