feat: Support applying BackendTlsPolicy and other backend-modifying configurations on custom backends

*Description*:
I was playing around with my [prototype](https://github.com/wtzhang23/xds-backend) of a custom backend ref by trying to apply a BackendTlsPolicy on it. I noticed that the TLS settings weren't getting applied. Here were the configurations I tested:
```
apiVersion: v1
kind: ConfigMap
metadata:
name: backend-tls-ca-cert
namespace: envoy-gateway-system
data:
ca.crt:
---
# my custom backend
apiVersion: xdsbackend.wtzhang23.github.io/v1alpha1
kind: XdsBackend
metadata:
name: test-backend-tls
namespace: envoy-gateway-system
spec:
server:
server: fileeds-server
service: test-http-service-tls
apiType: GRPC
---
apiVersion: gateway.networking.k8s.io/v1
kind: BackendTLSPolicy
metadata:
name: test-backend-tls-policy
namespace: envoy-gateway-system
spec:
targetRefs:
- group: xdsbackend.wtzhang23.github.io
kind: XdsBackend
name: test-backend-tls
validation:
caCertificateRefs:
- name: backend-tls-ca-cert
kind: ConfigMap
group: ""
hostname: test-http-service.test-namespace.svc.cluster.local

```

As a feature request, I'd like to know if it would be possible if we pre-applied the backend tls policy for custom backend refs before sending to an extension server for processing the PostClusterModify hook.

My guess is that this is due to the application of the TLS configurations being short-circuited by the return [here](https://github.com/envoyproxy/gateway/blob/973a0d04fd1f578a71efa5899396e40b8fdabe17/internal/gatewayapi/route.go#L1801-L1821). I assume if the TLS field was specified in that return value this would allow the backend tls policy to apply?

[optional *Relevant Links*:]
>Any extra documentation required to understand the issue.