External Auth via Backend resource does not modify destination URI, only changes SNI header

**DESCRIPTION**

We are attempting to configure External Auth using Envoy Gateway's SecurityPolicy, where the target OAuth2-Proxy service is located outside the cluster (in a different cluster from where Envoy is running).

What works (in-cluster setup):
We successfully configured both Envoy and OAuth2-Proxy with the OAuth2-Proxy running in-cluster (same cluster as Envoy). In this scenario, we point the SecurityPolicy directly to the Envoy Service, and authentication works correctly:
yaml

```yaml
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
name: oidc-example
spec:
extAuth:
http:
backendRefs:
- name: krws-oauth-proxy-oauth2-proxy
namespace: oauth-proxy
port: 80
path: '/oauth2/auth'
```

What doesn't work (external Backend resource):
Once the in-cluster setup was verified, we modified the SecurityPolicy to use a Backend resource that points externally to the OAuth2-Proxy service (running in a different cluster):
```yaml
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: Backend
metadata:
name: oauth-backend
spec:
endpoints:
- fqdn:
hostname: auth2-proxy.mydomain.com
port: 443
tls:
sni: auth2-proxy.mydomain.com
insecureSkipVerify: true

apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
name: oidc-example
spec:
extAuth:
http:
backendRefs:
- name: oauth-backend
group: gateway.envoyproxy.io
kind: Backend
```

Bug behavior:
When using the Backend resource in the SecurityPolicy for external auth, the proxied request does not modify the destination URI to point to the OAuth2-Proxy backend. Instead, it forwards the request to the same URI as the original web request used for authentication, only changing the SNI header. This results in a 404 error on the OAuth2-Proxy side because the route is not found.

Evidence (destination Envoy (oauth-proxy cluster) log):
text

envoy-gateway-system/envoy-envoy-gateway-system-eg-5391c79d-5b95bf7c7b-pkw7v[envoy]:
{":authority":"deepl-traductor-test.mydomain.com","GET","protocol":"HTTP/1.1",
"requested_server_name":"auth2-proxy.mydomain.com","response_code":404,
"response_code_details":"route_not_found"}

As shown in the log, the :authority header retains the original request host (deepl-traductor-test.mydomain.com) instead of being changed to the OAuth2-Proxy backend host (auth2-proxy.mydomain.com). Only the requested_server_name (SNI) is correctly set.

Expected behavior:
When using a Backend resource with an external FQDN in a SecurityPolicy for external auth, the request should be properly forwarded to the destination URI specified in the Backend configuration (including correct :authority header), not just modify the SNI.

Impact:
This bug forces us to install a separate OAuth2-Proxy instance in each cluster, which creates significant scalability and efficiency problems. Being able to use a single centralized OAuth2-Proxy instance across multiple clusters is critical for our architecture.

ENVIRONMENT:

Tested with Envoy 1.7.0 and 1.8.0