Allow targetRef policies to apply to multiple kuma.io/service tags

The DPPs to apply the policies to will have unique values for 'kuma.io/service' tag, semi-unique (1 of 2) values for 'kuma.io/service-name' tag, and the same value for 'kuma.io/namespace' tag.

Use of the `kuma.io/namespace' tag will work, but is not ideal because it prevents multiple applications from being deployed to a single namespace. Use of multiple policies (a policy per `kuma.io/service` or `kuma.io/service-name` tag) also is not ideal as it adds a great deal of complexity to the creation and maintenance of the policies.

Ideally, replicating the behavior seens in standard policies where matches can be made on multiple service tags

sources:

- match:

kuma.io/service: test-app1_test-app1_svc_8080

- match:

kuma.io/service: test-app1-preview_test-app1_svc_8080

- match:

kuma.io/service: test-app1_test-app1_svc_6565

- match:

kuma.io/service: test-app1-preview_test-app1_svc_6565