The witness is the "proof" part of a SegWit transaction: signatures, public keys and scripts that show the spender is allowed to spend. BIP141 moved this data into a separate structure attached to each input.
Why separate it?
The txid is calculated without the witness. Because signatures can be changed slightly by third parties without invalidating them (malleability), the old txid could change before confirmation. Excluding the witness fixes this, which made chains of unconfirmed transactions, like the Lightning Network, safe to build.
Cheaper block space
Witness bytes count as 1 weight unit each, while other bytes count as 4. This is why SegWit and Taproot spends usually cost less in fees.
wtxid
A second ID, the wtxid, does include the witness. Blocks commit to all wtxids through a special output in the coinbase transaction, so the witness is still protected by proof of work.