SecurityPolicy: Reduce listener churn for route-level extAuth policies

Applying a new route-level SecurityPolicy with extAuth can update the listener/HCM filter chain, which may disrupt existing long-lived connections such as websockets on unrelated routes.

Could EG make extAuth behave more like Lua, where the listener-level filter remains stable and policy-specific config is pushed into per-route config where Envoy supports it?