feat: add sds allowedNamespaces in EnvoyProxy

[zirain]

Follow up #8745

[netlify]

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Name	Link
🔨 Latest commit	50774dd
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/69faafa7950c4900088c8d4c
😎 Deploy Preview	https://deploy-preview-8917--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 50774dd2bd

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Preserve namespace labels before matching SDS selectors

When sdsConfig.allowedNamespaces is used with the file provider or egctl translate, this match sees empty labels because the shared YAML loader constructs Namespace resources with only ObjectMeta.Name (internal/gatewayapi/resource/load.go:278-286, reached from internal/provider/file/resources.go:54). A manifest that includes Namespace labels and an SDS Secret in that namespace will therefore be rejected even though the selector should match; the loader needs to preserve Namespace metadata before this selector check can work outside the Kubernetes provider.

Useful? React with 👍 / 👎.

[codecov]

Codecov Report

❌ Patch coverage is 90.90909% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 74.71%. Comparing base (53b9963) to head (50774dd).
⚠️ Report is 101 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/gatewayapi/backendtlspolicy.go	90.32%	1 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8917      +/-   ##
==========================================
+ Coverage   74.67%   74.71%   +0.03%     
==========================================
  Files         251      251              
  Lines       40398    40511     +113     
==========================================
+ Hits        30169    30266      +97     
- Misses       8157     8169      +12     
- Partials     2072     2076       +4     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

This pull request has been automatically marked as stale because it has not had activity in the last 30 days. Please feel free to give a status update now, ping for review, when it's ready. Thank you for your contributions!