Allow waypoint by default very hard to debug

[linsun]

(This is used to request new product features, please visit https://github.com/istio/istio/discussions for questions on using Istio)

Describe the feature request

Spent an hour debugging why sleep can't access productpage via its bookinfo gateway. Still not sure why but it is related to the allow waypoint by default because the productpage's ztunnel denied the req as I don't have any L4 authz policy deployed myself. The auto added policies are hard to reason about:

 istioctl x ztunnel-config policy -o yaml
- action: Allow
  name: istio_allow_waypoint_default_bookinfo-gateway
  namespace: default
  rules:
  - - - principals:
        - Exact: cluster.local/ns/default/sa/bookinfo-gateway-istio
  scope: WorkloadSelector
- action: Allow
  name: istio_allow_waypoint_default_reviews-svc-waypoint
  namespace: default
  rules:
  - - - principals:
        - Exact: cluster.local/ns/default/sa/reviews-svc-waypoint
  scope: WorkloadSelector
- action: Allow
  name: istio_allow_waypoint_default_reviews-v2-pod-waypoint
  namespace: default
  rules:
  - - - principals:
        - Exact: cluster.local/ns/default/sa/reviews-v2-pod-waypoint
  scope: WorkloadSelector
- action: Allow
  name: istio_allow_waypoint_default_waypoint
  namespace: default
  rules:
  - - - principals:
        - Exact: cluster.local/ns/default/sa/waypoint
  scope: WorkloadSelector

Disabled the feature and things start to work.

Describe alternatives you've considered

Affected product area (please put an X in all that apply)

[x ] Ambient
[ ] Docs
[ ] Dual Stack
[ ] Installation
[ ] Networking
[ ] Performance and Scalability
[ ] Extensions and Telemetry
[ ] Security
[ ] Test and Release
[x ] User Experience
[ ] Developer Infrastructure

Affected features (please put an X in all that apply)

[ ] Multi Cluster
[ ] Virtual Machine
[ ] Multi Control Plane

Additional context

[keithmattix]

Good call out Lin! We should address this before 1.22 if at all possible