fix: handle missing generic L7 metadata entries

[immanuwell]

generic l7_proto enforcement in cilium.network assumes dynamicMetadata().filter_metadata()[l7proto] is always there.
when that namespace is missing, onData() hits .at(l7proto_) and throws. not great.

this treats the missing namespace as empty metadata and keeps the policy path running. also adds a small regression test.

repro

1. configure a generic l7_proto policy with metadata_rule
2. hit cilium.network::onData() before any filter writes dynamicMetadata().filter_metadata()[l7proto]
3. current code throws on .at(l7proto_)

note: i couldnt run bazel test //tests:network_filter_test here, local bazel gets stuck earlier on a rules_foreign_cc toolchain bootstrap failure.

[nezdolik]

@immanuwell please fix ci checks

[immanuwell]

@nezdolik fixed all CI checks, and switched to peer-class approach you suggested

[nezdolik]

@immanuwell more ci checks need fixing

[immanuwell]

@nezdolik I am sorry but now after latest push all CI checks should be green
can you trigger it please?

[immanuwell]

remaining CI failure occurs before PR code runs: pull_request_target blocks checking out fork code for safety

[nezdolik]

@immanuwell raised a fix here #1975 for pull_request_target. Once it gets merged you will need to rebase on top of latest main, that should fix asan and "ci build & push" ci workflows. The format ci failure is legit though and needs to be addressed by you.

[immanuwell]

@nezdolik rebased onto that #1975