feat: Support secure query parameter credential injection for backends requiring API key in URL

## Description

The `HTTPRouteFilter` `credentialInjection` spec currently supports injecting credentials (API keys, JWTs, Bearer tokens) into HTTP request **headers** via the Envoy `credential_injector` HTTP filter. This keeps the credential value out of the `HTTPRouteFilter` manifest — it is read securely from a Kubernetes Secret at proxy runtime.

However, several backends — including MCP Servers — require credentials to be passed as a **URL query parameter** rather than a header (e.g. `?api_key=`, `?access_token=`). The Envoy AI Gateway (`envoyproxy/ai-gateway`) exposes a `queryParam` field in its `BackendSecurityPolicy` for exactly this use case. Today, AI Gateway implements this by generating an `HTTPRouteFilter` with a `urlRewrite` (path rewrite appending the query string) or a `requestHeaderModifier`, with the **API key literal embedded directly in the generated filter manifest**. Even when the user specifies a `secretRef`, the controller resolves and inlines the secret value into the `HTTPRouteFilter`, which exposes the credential in the Kubernetes resource.

The desired behavior is to allow query-parameter-based credentials to be injected at the Envoy data-plane level — reading from the secret at proxy runtime — without ever materializing the secret value in any Kubernetes API object. This is already how header-based credential injection works today via `HTTPRouteFilter` `credentialInjection`, and the same security guarantee should extend to query parameter injection.

## Relevant Links

- Envoy Gateway credential injection docs: https://gateway.envoyproxy.io/docs/tasks/security/credential-injection/
- `HTTPCredentialInjectionFilter` API type: https://gateway.envoyproxy.io/docs/api/extension_types/#httpcredentialinjectionfilter
- Envoy AI Gateway `BackendSecurityPolicy` API (`queryParam` field): https://aigateway.envoyproxy.io/docs/api/#backendsecuritypolicyapikey
- Upstream Envoy `credential_injector` filter: https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/credential_injector_filter
- Related: Support HTTPRouteFilter as a Backend Filter #5351