doc: add note about PA config with selectors being ignored in rootNamespace (#3604)

* doc: add note about PA config with selectors being ignored in rootNamespace

* gen files

Author: leosarra

security/v1beta1/peer_authentication.pb.go

@@ -44,6 +44,8 @@ syntax = "proto3";
 // ```
 // For mesh level, put the policy in root-namespace according to your Istio installation.
 //
+// Note: PeerAuthentication policies with workload selectors are ignored when deployed in the root namespace.
+//
 // Policies to allow both mTLS and plaintext traffic for all workloads under namespace `foo`, but
 // require mTLS for workload `finance`.
 // ```yaml