String functions in CEL expressions in responseOverride

*Description*:
We would like to use this expression to escape `&` in the Location header that we set to redirect to a login page

`%CEL(request.path.replace("&", "%%26"))%`

```yaml
responseOverride:
- match:
statusCodes:
- type: Value
value: 401
response:
header:
set:
- name: Location
value: https://example.dev/oidc/login?rd="%REQ(:scheme)%://%REQ(:authority)%%CEL(request.path.replace("&", "%%26"))%"
statusCode: 302
```

But the Envoy proxy logs this:
`failed to create an expression: No overload found in reference resolve step for replace`

[optional *Relevant Links*:]
I found this PR, which sounds like it added string function to CEL expressions, but maybe not in this context?

https://github.com/envoyproxy/envoy/pull/40510

Start by tracing how responseOverride values are parsed and how CEL expressions are created, then compare that path with the string-function support discussed in PR 40510. Confirm the requested replace expression works in this context, preserves the intended Location header escaping, and add a regression test covering the YAML configuration.

Written by the indexing model from the issue text.