Force HTTP -> HTTPS redirect only for hostnames served by gateway

In ingress-nginx any accepted Ingress route would automatically receive an HTTP -> HTTPS upgrade route as well. In Envoy-Gateway we replicated that following instructions on the envoy-gateway documentation.

However our security team has notified us that the current HTTP -> HTTPS redirect implementation reflects arbitrary Host headers without validation, creating a generic redirect that can be abused in SSRF or redirect-chain scenarios.

I also think that the documentation should include a warning that the example configuration makes the gateway a target for misuse by automated systems (malware etc) trying to circumvent outbound restrictions such as reputation systems or allowlists by abusing follow-redirects semantics where some security systems may not properly block this scenario.

Because as infrastructure providers we are not always easily able to determine the exact set of domains used by application developers, we would like an automated way to scope the redirects to only registered and accepted HTTPRoutes as was the case with ingress-nginx. We have considered alternatives like Kyverno to enforce individual HTTPRoutes for the redirects only for HTTPRoutes requested by application developers, however we would prefer to not be dependent on external systems to enforce this requirement.

[optional *Relevant Links*:]
https://gateway.envoyproxy.io/docs/tasks/traffic/http-redirect/#force-http--https-redirect