Support for Injecting Leftmost Client IP from X-Forwarded-For as X-Real-Client-IP Header

*Description*:
I need Envoy Gateway to extract the leftmost (original) client IP from the X-Forwarded-For header and inject it as the X-Real-Client-IP header on requests to my backend.

Background:
Our network flow is:
Client → proxy (optional) → frontdoor → ALB controller → Envoy Gateway → backend

We currently use in ClientTrafficPolicy
```
clientIPDetection:
xForwardedFor:
numTrustedHops: 2
```
but the number of proxies between the client and frontdoor is unpredictable and varies by region. We cannot rely on numTrustedHops or trustedCIDRs, as proxy IPs are not known in advance.

*Problem*:
We need to whitelist the real client IP, which is always the leftmost value in X-Forwarded-For.
Ingress controllers can extract this reliably, but Envoy Gateway does not support dynamic extraction or injection of the leftmost IP as X-Real-Client-IP.
Current APIs (ClientTrafficPolicy, EnvoyPatchPolicy, JSONPatch) do not provide a way to do this.

Please add support for extracting the leftmost IP from X-Forwarded-For and injecting it as X-Real-Client-IP, similar to ingress controllers.
Ideally, this should be configurable and not require static numTrustedHops or trustedCIDRs.

Security policies and backend logic depend on the real client IP.
Our clients may use unpredictable proxies, so static hop counts or CIDR lists are not feasible in our use case.