tcp_proxy/ext_authz: Support authorization-driven routing for server-first protocols

*Title*: *Support authorization-driven routing for server-first protocols*

*Description*:

Currently, dynamic cluster selection through network ext_authz can be delayed until downstream data is received. This does not work for server-first protocols such as SMTP, where the upstream must send data before the downstream sends application data. Can we add a supported way for ext_authz to complete and set the cluster via filter state before tcp_proxy establishes the upstream connection, without requiring downstream data?

*Relevant Links*:
- #40827: earlier check_on_new_connection proposal
- #41283: related authorization-on-connection work
- #42389: check_on_transport_ready proposal
- #43760: ON_DOWNSTREAM_DATA support in set_filter_state
- #44109: delayed tcp_proxy route selection

Start with the tcp_proxy/ext_authz behavior described in the issue and read the related proposals in #40827, #41283, #42389, #43760, and #44109. Determine how authorization can complete before downstream data for server-first protocols, then validate that routing can set filter state before tcp_proxy establishes the upstream connection.

Written by the indexing model from the issue text.