Issue title: Make KFServing accessible from GCP IAP Ingress
 Issue body: /kind feature

**Describe the solution you'd like**
This is a follow up for https://github.com/kubeflow/kfserving/issues/760

in GCP/IAP setup, KFServing inference service is protected behind IAP and in order to access from outside, we need additional virtual service rule to work with path based routing because currently KFServing only supports host based routing. So we need to add additional rule in KFServing top level virtual service to rewrite url path and convert to host based routing. 

```
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: kfserving-kubeflow-yuzi-dan-kfserving-test
  namespace: kubeflow-yuzi-dan
spec:
  gateways:
  - kubeflow/kubeflow-gateway
  hosts:
  - '*'
  http:
  - match:
    - uri:
        prefix: /kfserving/kubeflow-yuzi-dan/sklearn-iris
    rewrite:
        uri: /v1/models/sklearn-iris:predict
    route:
    - destination:
        host: cluster-local-gateway.istio-system.svc.cluster.local
      headers:
        request:
          set:
            Host: sklearn-iris-predictor-default.kubeflow-yuzi-dan.svc.cluster.local
      weight: 100
    timeout: 300s
```

**Anything else you would like to add:**
[Miscellaneous information that will assist in solving the issue.]

 Comments: 
 Comment 0: Issue-Label Bot is automatically applying the labels:

| Label  | Probability |
| ------------- | ------------- |
| area/inference | 0.76 |

Please mark this comment with :thumbsup: or :thumbsdown: to give our bot feedback! 
Links: [app homepage](https://github.com/marketplace/issue-label-bot), [dashboard](https://github.com/marketplace/issue-label-botdata/kubeflow/kfserving) and [code](https://github.com/hamelsmu/MLapp) for this bot.
 Comment 1: Issue Label Bot is not confident enough to auto-label this issue.
                See [dashboard](https://github.com/marketplace/issue-label-botdata/kubeflow/kfserving) for more details.
                
 Comment 2: /good-first-issue
 Comment 3: @yuzisun: 
	This request has been marked as suitable for new contributors.

Please ensure the request meets the requirements listed [here](https://git.k8s.io/community/contributors/guide/help-wanted.md#good-first-issue).

If this request no longer meets these requirements, the label can be removed
by commenting with the `/remove-good-first-issue` command.


<details>

In response to [this](https://github.com/kubeflow/kfserving/issues/824):

>/good-first-issue


Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>
 Comment 4: @yuzisun I'd like to work on this. Can you explain a bit more and suggest a starting point?
 Comment 5: @kaivalya97 - I'm in a similar position to you.  I'd also like to help.  It might be easier to discuss no kubeflow kfserving slack channel.
 Comment 6: @kaivalya97 @owennewo Currently KFServing creates a top level virtual service for routing so we could add additional path based routing rules or a separate virtual service based on a configuration. You can join our WG meeting to discuss this and take a look at the code [here](https://github.com/kubeflow/kfserving/blob/master/pkg/controller/inferenceservice/resources/istio/virtualservice.go#L182) to get some ideas. 
 Comment 7: @kaivalya97 here is doc for GCP/IAP https://github.com/kubeflow/kfserving/tree/master/docs/samples/gcp-iap and explained what changes are needed, let me know if you need more information.
 Comment 8: @yuzisun , I have 2 questions about the gcp-iap sample 

(I am using Kubeflow 1.1 in GCP deployed using gcp-blueprint)

1- In script [make-prediction.sh](https://github.com/kubeflow/kfserving/blob/master/docs/samples/gcp-iap/make-prediction.sh) , i need to set the variable ${INGRESS_DNS} - the external dns of the loadbalancer service / gateway

How could I retrieve the external dns of the loadbalancer ?

Is it the HOSTS or Address when I run ` kubectl -n istio-system get ingress` ?
```
NAME            HOSTS                                      ADDRESS         PORTS   AGE
envoy-ingress   my-kfname.endpoints.my-project.cloud.goog   xx.xx.xx.xx   80      14d
```

Or is it something else ?


2- After applying kubectl apply -f sklearn-iap-with-authz.yaml, I need to add a new AuthorizationPolicy that allows access to this inference URI from a specified ServiceAccount or Namespace.
Is there any example how to create this AuthorizationPolicy ?

Thanks
 Comment 9: Hello everyone!

I created a pull-request for this. Let's discuss there:
- https://github.com/kserve/kserve/pull/2357
{'source': 'GithubIssues', 'repo_name_with_owner': 'kubeflow/kfserving', 'issue_id': 617841837, 'repo_stars': 1102.0}