Add Gateway API auth migration controls

[schmitch]

Summary

• add opt-in Envoy Gateway SecurityPolicy.extAuth emission for Pangolin badger middleware routes
• add CONFIG_RECONCILE_ONLY scoped apply/GC for testing a subset of generated objects
• allow CONFIG_RECONCILE_ONLY to accept hostnames, expanding matching hosts to their HTTPRoute, SecurityPolicy, generated backend objects, and shared ListenerSet
• add optional Pangolin dashboard HTTPRoutes and Gerbil UDPRoute/listener generation
• document the configuration changes needed for migration, including ext_auth shim, hostname scoped rollout, dashboard, Gerbil settings, the old-IP plus separate-Envoy-IP Gerbil migration pattern, and a shared-IP HTTP/HTTPS-only Envoy replacement path based on the upstream Helm chart topology
• update RBAC/deployment docs and transform/config/reconcile tests for the new knobs

Verification

• cargo fmt --check
• cargo test --no-run
• cargo test
• git diff --check