RFE: Report conflicting Auth Policies

[andrewjjenkins]

I can write AuthPolicies that conflict. For instance, the first policy turns mTLS on and the second turns it off:

apiVersion: "authentication.istio.io/v1alpha1"
kind: "Policy"
metadata:
  name: "example-1"
  namespace: "bar"
spec:
  targets:
  - name: httpbin
    ports:
    - number: 8001
  peers:
  - mtls: {}
---
apiVersion: "authentication.istio.io/v1alpha1"
kind: "Policy"
metadata:
  name: "example-2"
  namespace: "bar"
spec:
  targets:
  - name: httpbin
    ports:
    - number: 8001
  peers:

In this case, behavior by pilot appears to be non-deterministic (for 0.8.0 at least, I would observe different behavior each time I applied these policies). In any case, it's hard to decide what to do and the user probably didn't mean to configure this way. We should warn them.