Add support for specifying anonymous/public paths for apps

flyteidl2/app/app_definition.proto

@@ -351,6 +351,22 @@ message SecurityContext {
   // AllowAnonymous indicates if the app should be accessible without authentication. This assumes the app will handle
   // its own authentication or that it's a public app.
   bool allow_anonymous = 5;
+
+  // List of URL paths that are publicly accessible without authentication.
+  // Each entry must start with "/". Matching is currently path-segment-aware
+  // prefix matching:
+  //   - "/api"  matches "/api" exact and "/api/..." (NOT "/apifoo")
+  //   - "/api/" matches "/api/..." only (NOT bare "/api")
+  // Query strings and fragments are stripped from the request path before matching.
+  // Independent from allow_anonymous; if allow_anonymous is true, the entire app
+  // is public and these paths have no additional effect.
+  // Catastrophic entry "/" makes the whole app public — equivalent to
+  // allow_anonymous=true. This is intentional.
+  repeated string anonymous_paths = 6 [
+    (buf.validate.field).repeated.max_items = 50,
+    (buf.validate.field).repeated.items.string.min_len = 1,
+    (buf.validate.field).repeated.items.string.pattern = "^/.*"
+  ];
 }
 
 message ImageSpec {