Listener with no routes causes xDS rejection when sharing port with HTTPS listener

*Description*:

When a Gateway has both an HTTPS listener (TLS terminate, no hostname) and a TCP or TLS listener on the same port, and the TCP/TLS listener has no routes attached, Envoy rejects the xDS listener update with a duplicate filter chain matcher error.

The error is continuous and blocks all xDS updates for the affected listener, meaning any subsequent configuration changes to that listener are also rejected until a route is added.

Expected behaviour: a TCP or TLS listener with no routes but a specific hostname should not conflict with other listeners on the same port.

*Repro steps*:

Apply the manifest below to a cluster running Envoy Gateway. No TLSRoute is created for the `tls-passthrough` listener.

```yaml
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: repro
namespace: default
spec:
gatewayClassName: envoy-gateway
listeners:
- name: https
port: 443
protocol: HTTPS
allowedRoutes:
namespaces:
from: All
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: repro-cert
- name: tls-passthrough
port: 443
protocol: TLS
hostname: '*.example.com'
allowedRoutes:
namespaces:
from: All
kinds:
- group: gateway.networking.k8s.io
kind: TLSRoute
tls:
mode: Passthrough
```

Check the Envoy proxy pod logs — the xDS update is rejected immediately.

Adding a TLSRoute that attaches to the tls-passthrough listener resolves the error, confirming the issue is specific to the no-routes case.

Environment:

- Envoy Gateway: 1.8.1
- Envoy Proxy: 1.38.2

Logs:
```
[warning][config] delta config for type.googleapis.com/envoy.config.listener.v3.Listener rejected: Error adding/updating listener(s) tcp-443: error adding listener '0.0.0.0:10443': filter
chain 'EmptyCluster' has the same matching rules defined as 'default/repro/https'. duplicate matcher is: {}
[warning][config] gRPC config for type.googleapis.com/envoy.config.listener.v3.Listener rejected: Error adding/updating listener(s) tcp-443: error adding listener '0.0.0.0:10443': filter
chain 'EmptyCluster' has the same matching rules defined as 'default/repro/https'. duplicate matcher is: {}
```