AI Gateway 2.1: Support for routing AWS Bedrock traffic through PrivateLink/VPC endpoints

## Overview

AI Gateway 2.1 adds native support for routing AWS Bedrock traffic through PrivateLink/VPC endpoints using a dedicated `vpc_endpoint` configuration.

This replaces the current `upstream_url` workaround, which overrides the entire URL and can interfere with Bedrock path construction and streaming.

## Scope

Document:

* The new Bedrock `vpc_endpoint` configuration.
* When to use it instead of `upstream_url`.
* Support for both **chat/invoke and embeddings**.
* How Kong continues to construct the Bedrock API path while only overriding the connection host.
* SigV4 behavior: signing continues to use the configured AWS region and Bedrock service.
* Behavior/validation when both `vpc_endpoint` and `upstream_url` are configured, based on the final implementation.

## Examples (TBC)

Provide complete **Konnect API** and **kongctl** examples in the Bedrock provider reference page:

```yaml
model:
provider: bedrock
name: anthropic.claude-3-5-sonnet-20241022-v2:0
options:
bedrock:
aws_region: us-east-1
vpc_endpoint: vpce-0123456789abcdef.bedrock-runtime.us-east-1.vpce.amazonaws.com
```

Include examples for both Bedrock inference and embeddings where their configuration differs, confirm the exact schema with engineering

Size: M
Person of contact:
PRD: https://docs.google.com/document/d/11xqivPZX7Kdm9ba13sIPTdHJmwsK1pzksAaNcrBYJM8/edit?tab=t.0#heading=h.mpw3azkpnz6n

Start with the Bedrock provider reference page and confirm the final schema and validation behavior with engineering. Document vpc_endpoint versus upstream_url, including SigV4, path construction, chat/invoke, and embeddings. Add complete Konnect API and kongctl examples, and consider the work done when both provider scenarios and the dual-configuration behavior are covered.

Written by the indexing model from the issue text.