iap jwt public key service

[kunmingg]

When Istio is configured to use IAP jwt, istio need to access
jwksUri: https://www.gstatic.com/iap/verify/public_key-jwk for jwt verification.
However above uri is not accessible from a private network.

This PR contains a k8s service that host the same public key as https://www.gstatic.com/iap/verify/public_key-jwk to allow jwt verification within cluster.

Note: the config map need update if the IAP public key rotate.

To apply the new pkg, user can either add it to kfdef or directly
kustomize build ... | kubectl apply ...

Checklist:

• Unit tests have been rebuilt:
  1. cd manifests/tests
  2. make generate-changed-only
  3. make test

---

This change is 

[zhenghuiwang]

@kunmingg could you add a comment or README about how to use these uitls? (Is it just kubectl apply ..?)

[zhenghuiwang]

/lgtm

Feel free to merge it if you plan to add docs later

[kunmingg]

@zhenghuiwang PR description updated.

/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: kunmingg

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [kunmingg]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment