Support top-level exclusions in BackendTrafficPolicy rate limiting

*Description*:
The existing invert support on HeaderMatch, SourceMatch, etc. (added in [#4286](https://github.com/envoyproxy/gateway/pull/4286) and [#8407](https://github.com/envoyproxy/gateway/pull/8407)) allows excluding specific traffic from individual rate limit rules. However, when a BackendTrafficPolicy has multiple rules, the exclusion must be duplicated into the clientSelectors of every rule... there is no way to declare it once and have it apply globally.

A common use case is exempting internal services or trusted health-check agents from all rate limiting in one place:
```
# Current workaround (invert must be repeated on every rule)
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: BackendTrafficPolicy
metadata:
name: example
spec:
rateLimit:
global:
rules:
- clientSelectors:
- headers:
- name: User-Agent
value: internal-health-checker
invert: true
limit:
requests: 100
unit: Minute
- clientSelectors:
- headers:
- name: User-Agent
value: internal-health-checker
invert: true
- sourceCIDR:
value: 0.0.0.0/0
type: Exact
limit:
requests: 1000
unit: Hour
# ... and so on for every rule
```

Proposed API:

Add an Exclusions field to both GlobalRateLimit and LocalRateLimit. If a request matches any exclusion condition, all rate limit rules are skipped for that request.
```
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: BackendTrafficPolicy
metadata:
name: example
spec:
rateLimit:
global:
exclusions:
- headers:
- name: User-Agent
value: internal-health-checker
- sourceCIDR:
value: 10.0.0.0/8
rules:
- clientSelectors: ...
limit:
requests: 100
unit: Minute
- clientSelectors: ...
limit:
requests: 1000
unit: Hour
```

The exclusions field could reuse the existing RateLimitSelectCondition type (conditions within one entry are ANDed; multiple entries are ORed), matching the existing clientSelectors semantics.

I'd be willing to work on this - wanted to gauge interest/reception and get any guidance on implementation.