Description:
Add requestTimeout and requestHeadersTimeout to clientTrafficPolicy.

According to Envoy documentation, These fields should be configured in the presence of untrusted downstreams.

Additionally, according to the Envoy best practices, configuring the request_timeout is recommended. It is emphasized that this setting "must be disabled for long-lived and streaming requests". hence, instead of enabling it by default, I propose making this field configurable.

These fields weren't previously discussed in this issue because requestHeadersTimeout was not explicitly mentioned in the best-practices document, and requestTimeout wasn't enforced by default to avoid potential disruptions to certain clients (as discussed above).

Links:

• request_timeout and request_headers_timeout in Envoy Docs
• Envoy best practices