docs: regenerate API reference for CSRF filterEnabled/shadowEnabled

Signed-off-by: asalvador <asalvador@newrelic.com>

Author: albsga4

site/content/en/latest/api/extension_types.md

@@ -846,12 +846,19 @@ The CSRF filter checks that the Origin header in HTTP requests matches the desti
 preventing cross-origin mutating requests (POST, PUT, DELETE, PATCH) from being processed.
 GET and HEAD requests are always allowed.
 
+Note: Envoy's CSRF filter compares against the host and port of the origin only
+(the scheme is stripped before matching). Additional origins must be specified as
+host or host:port values, not full URLs. For example, use "www.example.com"
+instead of "https://www.example.com".
+
 _Appears in:_
 - [SecurityPolicySpec](#securitypolicyspec)
 
 | Field | Type | Required | Default | Description |
 | ---   | ---  | ---      | ---     | ---         |
-| `additionalOrigins` | _[StringMatch](#stringmatch) array_ |  false  |  | AdditionalOrigins specifies additional origins that are allowed to make requests.<br />These are checked against the Origin header and if matched, the request is allowed.<br />Each origin can be an exact, prefix, suffix, or regex match using StringMatch. |
+| `filterEnabled` | _integer_ |  false  |  | FilterEnabled specifies the percentage of requests for which the CSRF filter is enabled.<br />When set, only the given percentage of requests will have CSRF protection enforced.<br />Defaults to 100 (fully enabled) if not specified. |
+| `shadowEnabled` | _integer_ |  false  |  | ShadowEnabled specifies the percentage of requests for which the CSRF filter is in<br />shadow/dry-run mode. In this mode, the filter evaluates requests and tracks whether<br />they would be allowed or rejected, but does not enforce the policy.<br />This is useful for rolling out CSRF protection gradually while monitoring the impact.<br />Only takes effect when FilterEnabled is not set or is 0. |
+| `additionalOrigins` | _[StringMatch](#stringmatch) array_ |  false  |  | AdditionalOrigins specifies additional origins that are allowed to make requests,<br />beyond the destination origin. These are checked against the Origin header (host:port only,<br />not the full URL) and if matched, the request is allowed.<br />Each origin supports Exact, Prefix, Suffix, and RegularExpression matching. |
 
 
 #### CircuitBreaker