fix(webhook): warn when identity.type=spiffe is emitted without jwt_audience

[akram]

Summary

In synthesizePipeline(), when ClientAuthType == "federated-jwt", the webhook sets identity.type=spiffe unconditionally but only sets jwt_audience when JWTAudience != "". If the authbridge-config CM is hand-authored or from a pre-upgrade install without JWT_AUDIENCE, the authbridge binary will crash at startup with:

identity.type=spiffe requires identity.jwt_audience to be set

Operator-managed CMs always have JWT_AUDIENCE populated (written by buildConfigMapData), so this only affects hand-authored CMs.

Suggested fix

Add a log warning in synthesizePipeline() when identity.type=spiffe is set but JWTAudience is empty, so operators get a heads-up before the pod crashes. Failing loudly is the right behavior (wrong audience is worse than a crash), but a warning makes the root cause more discoverable.

Context

• Flagged by @huang195 in inline review comment on pod_mutator.go:910
• PR Refactor: remove SPIRE_ENABLED from authbridge-config and per-namespace envoy-config CM #447 merged the jwt_audience fix but deferred the warning