feat(gatewayapi): support SDS listener certificate references

[Sharvash]

What this PR does / why we need it:

Allow Gateway listeners to use gateway.envoyproxy.io/sds Secrets in tls.certificateRefs when enableSDSSecretRef is enabled.

This change:

• validates SDS certificate references and preserves ReferenceGrant checks
• passes SDS configuration through the IR
• creates static UDS clusters for downstream certificate delivery
• prevents cluster name collisions by adding a hash to Unix socket cluster names
• reports when certificate DNS names cannot be inspected and applies the existing ALPN safety behavior
• adds documentation, release notes, translator fixtures, and Kubernetes E2E coverage

The Unix socket cluster naming change affects existing generated xDS. EnvoyPatchPolicies and extension servers that refer to the previous cluster names must be updated. This is documented in the breaking-change release note.

Which issue(s) this PR fixes:

Fixes #8915

---

PR Checklist

• Authorship & ownership: Coding agents / AI assistants are welcome, but I have reviewed every change, understand how and why it works, can explain and maintain it, and take full responsibility for this PR. I have not submitted generated output I do not understand.
• DCO: All commits are signed off (git commit -s).
• API agreed first: N/A - this PR does not change files under /api.
• Required checks pass: Full make generate gen-check, make lint, and coverage checks have not been run locally.
• Tests added/updated: Added gateway API, IR, xDS translator, SDS server, and E2E coverage.
• Docs: Added SDS listener configuration and security guidance.
• Release notes: Added new-feature and breaking-change fragments.
• Generated files committed: make gen-check has not been run locally.
• Scope & compatibility: The xDS cluster naming change is documented as breaking.
• Codex review: Not requested on GitHub yet.
• Copilot review: Not requested on GitHub yet.

[netlify]

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Name	Link
🔨 Latest commit	f8a6e4d
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/6a5cb0d94b67d4000810bfeb
😎 Deploy Preview	https://deploy-preview-9525--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[codecov]

Codecov Report

❌ Patch coverage is 84.17722% with 25 lines in your changes missing coverage. Please review.
✅ Project coverage is 75.56%. Comparing base (265fdeb) to head (f8a6e4d).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/xds/translator/sds.go	62.96%	7 Missing and 3 partials ⚠️
internal/gatewayapi/helpers.go	77.77%	2 Missing and 2 partials ⚠️
internal/gatewayapi/listener.go	87.87%	2 Missing and 2 partials ⚠️
internal/ir/sds.go	72.72%	2 Missing and 1 partial ⚠️
internal/gatewayapi/backendtlspolicy.go	50.00%	1 Missing and 1 partial ⚠️
internal/gatewayapi/translator.go	0.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9525      +/-   ##
==========================================
+ Coverage   75.53%   75.56%   +0.03%     
==========================================
  Files         252      253       +1     
  Lines       41646    41758     +112     
==========================================
+ Hits        31457    31556      +99     
- Misses       8062     8072      +10     
- Partials     2127     2130       +3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[zirain]

@arkodg , I would like to merge #9030 first if possible.