Watch ns configuration for gateway not separate to routes

Design bug not logic bug.

*Description*:
The `envoy-gateway.yaml` in the configmap doesn't appear to allow a distinct ns to watch for Gateway vs HTTPRoute and friends - therefore to allow httproutes (and friends) to be detected and actioned one is forced to allow gateway resources to be detected and actioned.

It seems to me that in the most common case you only want infrequent decisions made about gateway resources and a controlled set of them for specific uses. On the other hand the routes come along frequently with each new app or change in app behaviour and live with the app in the ns the app lives in.

Ideally these would be separated so that engineers could be entrusted with (some or all) write access (through whatever mechanism which whatever guard rails) to a ns where their workloads run without allowing them to create gateways and without forcing the access mechanism to be configured to exclude gateways.