Allow kube-apiserver webhook calls to netbird namespace

The netbird-operator webhook service runs in the netbird namespace and
receives admission webhook calls from kube-apiserver using node IPs
(172.28.101.0/24). Without this, ztunnel rejects the connections with
"allow policies exist, but none allowed".

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

infrastructure/istio/manifests/mesh/authorization-policies.yaml

@@ -280,6 +280,11 @@ spec:
         - source:
             namespaces:
               - prometheus
+    # kube-apiserver webhook calls to netbird-operator webhook service (node IPs)
+    - from:
+        - source:
+            ipBlocks:
+              - "172.28.101.0/24"
 
 ---
 # --- Netbird Operator: Allow intra-namespace + Prometheus ---