doc: add note about PA config with selectors being ignored in rootNamespace

[leosarra]

This is to document the behavior that comes from https://github.com/istio/istio/blob/4822be3a048e34c3c6bab4ec352d45d4091ca0be/pilot/pkg/security/authn/policy_applier.go#L421

[istio-testing]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[istio-policy-bot]

😊 Welcome @leosarra! This is either your first contribution to the Istio api repo, or it's been
a while since you've been here.

You can learn more about the Istio working groups, Code of Conduct, and contribution guidelines
by referring to Contributing to Istio.

Thanks for contributing!

Courtesy of your friendly welcome wagon.

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: leosarra / name: Leonardo Sarra (5562f4e, b880953)