Allow configuring JWT filter fetch behavior and failed refetch duration

*Description*:

Currently, Envoy Gateway hardcodes the use of **`async_fetch`** when generating the JWT HTTP filter XDS configuration [code link](https://github.com/envoyproxy/gateway/blob/da09b3a7a34690bbff1da2bfffb79ec5a55d20d4/internal/xds/translator/jwt.go#L162). Additionally, it does not provide a mechanism to configure the **`failed_refetch_duration`** [field](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/jwt_authn/v3/config.proto#extensions-filters-http-jwt-authn-v3-jwksasyncfetch) in the JWT filter.

As a result, when the JWKS server becomes temporarily unavailable, Envoy starts retrying indefinitely without any backoff or configurable delay, which can overwhelm the Identity Provider (IdP) infrastructure. The retry policy configuration has no effect on the remote_jwks when async_fetch mode enabled: [envoyproxy/envoy#40025](https://github.com/envoyproxy/envoy/issues/40025).

### Request

Envoy Gateway's `SecurityPolicy` or equivalent configuration should support:

1. An option to opt-out of `async_fetch` and fall back to `sync_fetch`.
2. A way to configure `failed_refetch_duration` to control the retry behavior when JWKS fetches fail.

This would provide users better resilience and control over how Envoy handles temporarily unreachable JWKS endpoints, especially in production environments where repeated retries can have cascading effects on upstream systems.