Address CodeRabbit review feedback on PR wso2#2012

- OperationUpstream schema now requires at least one of main or sandbox
  via anyOf, rejecting empty {} at the schema layer as defense in depth
  alongside the validator.
- Policy builder per-op sandbox check is now content-based (trims and
  checks Url/Ref non-empty) matching the apiSandboxHasContent pattern
  used elsewhere. Fixes asymmetric pointer-only check that would emit
  sandbox policy chains for empty sandbox wrappers.
- TestResolvePerOpUpstream_DedupSameURL now uses two distinct URLs with
  identical apiID|METHOD|path|env, asserting cluster name independence
  from URL. Pins the EDS-stable design contract.

Author: mehara-rothila

gateway/gateway-controller/api/management-openapi.yaml

@@ -4138,7 +4138,10 @@ components:
 
     OperationUpstream:
       type: object
-      description: Per-operation upstream override. Missing sub-fields fall back to API-level upstream.
+      description: Per-operation upstream override. Missing sub-fields fall back to API-level upstream. At least one of main or sandbox must be set.
+      anyOf:
+        - required: [main]
+        - required: [sandbox]
       properties:
         main:
           $ref: "#/components/schemas/Upstream"