Support per-backend ALPN configuration through BackendTLSPolicy options

*Description*:

Gateway API issue https://github.com/kubernetes-sigs/gateway-api/issues/4833 proposes adding per-backend ALPN protocol configuration to `BackendTLSPolicy`.

Envoy Gateway currently supports upstream ALPN configuration through `EnvoyProxy.spec.backendTLS.alpnProtocols`, but that setting is global for backend TLS. This is not fine-grained enough when different backends need different ALPN behavior, for example:

- gRPC backends that require `h2`
- legacy HTTPS backends that only support `http/1.1`
- deployments where different Services or Service ports need different ALPN lists

Gateway API `BackendTLSPolicy.spec.options` already provides an implementation-specific extension point. Envoy Gateway could support a domain-prefixed option key such as:

```yaml
apiVersion: gateway.networking.k8s.io/v1
kind: BackendTLSPolicy
metadata:
name: backend-tls-grpc
spec:
targetRefs:
- group: ""
kind: Service
name: grpc-backend
sectionName: https
validation:
hostname: grpc.example.com
wellKnownCACertificates: System
options:
gateway.envoyproxy.io/alpn-protocols: h2
```

Proposed behavior:

- Parse `gateway.envoyproxy.io/alpn-protocols` as a comma-separated ordered ALPN list.
- Apply the parsed value to the upstream TLS context for the backend selected by the policy.
- Let this BackendTLSPolicy option override `EnvoyProxy.spec.backendTLS.alpnProtocols`.
- Support at least the ALPN IDs Envoy Gateway already exposes in its TLS settings: `h2`, `http/1.1`, and `http/1.0`.

This would provide a practical implementation-specific bridge while Gateway API discusses whether to add a first-class `BackendTLSPolicy.spec.alpnProtocols` field.

We can also support other TLS options like `gateway.envoyproxy.io/min-tls-version`, `gateway.envoyproxy.io/min-tls-version`, `gateway.envoyproxy.io/cipher-suites` if needed.

[optional *Relevant Links*:]

- Gateway API upstream proposal: https://github.com/kubernetes-sigs/gateway-api/issues/4833
- Existing Envoy Gateway global backend TLS ALPN setting: `EnvoyProxy.spec.backendTLS.alpnProtocols`