AuthorizationPolicy still take effect by namespace scope after a workloadSelector added to it

[ZarrianShi]

Bug Description:

1. Create a namespace-scoped AuthorizationPolicy
2. Change it to workload-scoped by add WorkloadSelector to it
3. AuthorizationPolicy still take effect by namespace scope

Istio Version:
1.22.3

[bleggett]

Can you add an example for number 3 that shows exactly what you're talking about?

My understanding is adding workload selectors should further refine the existing namespace scope, not replace it.