SecurityPolicy.basicAuth has no configurable realm, causing WWW-Authenticate realm to vary per request path

Envoy's basic_auth filter defaults the WWW-Authenticate: Basic realm="..." value to the full request URL (scheme+host+path) when no realm is configured. Since SecurityPolicy.spec.basicAuth (v1alpha1) only exposes users and forwardUsernameHeader — no realm field — every distinct path under a protected route gets a different realm.

Per RFC 7617, browsers cache Basic Auth credentials keyed by (origin, realm). Because the realm changes per URL, browsers cannot reuse cached credentials across different paths of the same protected route, and re-prompt for credentials on every new path/page.

Repro:

curl -i https://example.com/api/foo   # www-authenticate: Basic realm="https://example.com/api/foo"
curl -i https://example.com/api/bar   # www-authenticate: Basic realm="https://example.com/api/bar"

Request: expose a realm field on BasicAuth (mirroring Envoy's envoy.extensions.filters.http.basic_auth.v3.BasicAuth config, if it supports one) so a fixed realm can be set per SecurityPolicy, allowing browsers to cache credentials correctly.

Envoy Gateway version: v1.8.2 (confirmed same limitation in main branch source as of now).