[BUG] ExponentialRetryBackoffStrategy retries only on IllegalStateException, never on real network errors

- severity: High
- files: `shenyu-plugin/shenyu-plugin-httpclient/src/main/java/org/apache/shenyu/plugin/httpclient/ExponentialRetryBackoffStrategy.java:65`
- description: `initDefaultBackoff` builds `Retry.backoff(...).filter(t -> t instanceof IllegalStateException)`. The actual outbound failures — `ConnectTimeoutException`, `ReadTimeoutException`, `IOException`, `WebClientResponseException`, "Connection prematurely closed" — are not `IllegalStateException`, so `retryWhen` never retries them. Compare `FixedRetryStrategy` which has no filter (retries all).
- impact: Operators configuring `retryBackoffSpec=exponential` get zero retries on transient connection/timeout failures — silent no-op.
- suggested_fix: Broaden the filter to admit `IOException`/`TimeoutException`/`ConnectTimeoutException`/`ReadTimeoutException`, or drop the filter.
- confidence: High
- related_existing: none — #6583/PERF-32 is the outer `.timeout()` wrapping; this is the inner `.filter()` that suppresses all retries regardless.

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/00-consolidated-critical-high.md`](docs/scan2-2026-08-02/00-consolidated-critical-high.md)._

Start at shenyu-plugin/shenyu-plugin-httpclient/src/main/java/org/apache/shenyu/plugin/httpclient/ExponentialRetryBackoffStrategy.java:65 and compare the retry behavior with FixedRetryStrategy. Trace the filter used by initDefaultBackoff and verify that the listed transient outbound failures are retried rather than suppressed; done when exponential backoff no longer silently performs zero retries for them.

Written by the indexing model from the issue text.