Templated Host Rewrite From Path Match

*Description*:

### Problem
Some backends have predictable hostnames, and the desired upstream host can be derived from part of the request path.

Example:

```
https://example.com/node/1/api
-> backend-1.service.namespace.svc.cluster.local

https://example.com/node/2/api
-> backend-2.service.namespace.svc.cluster.local
```

### Request
Today, Envoy Gateway supports host rewrite, and routes can match paths with regular expressions. However, there does not seem to be a native way to reuse a regex path capture when rewriting the upstream Host header.

```yaml
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: HTTPRouteFilter
metadata:
name: host-rewrite-from-path
spec:
urlRewrite:
hostname:
type: PathRegex
pathRegex:
pattern: "^/node/([0-9]+)/api.*"
substitution: "backend-\\1.service.namespace.svc.cluster.local"

```

This would allow a single route to map path segments to predictable backend hostnames without requiring Lua, ExtProc, Wasm, or one route per backend instance.

### Security Considerations

The API should avoid arbitrary host injection. Possible safeguards:

* Require the path match to be a regular expression with explicit capture groups.
* Allow only captured values in a fixed hostname template.
* Support validation such as numeric-only captures or min/max bounds.
* Reject requests where the capture is missing or invalid.
* Document interaction with DynamicResolver if the rewritten host is resolved dynamically.

[optional *Relevant Links*:]
>Any extra documentation required to understand the issue.