Expose maxHosts for DynamicResolver DNS cache

Description:

We are using Envoy Gateway v1.8.1 with Backend type DynamicResolver.

In our environment, the generated Envoy Dynamic Forward Proxy DNS cache has reached the default Envoy max_hosts limit of 1024.

Metric:

```text
envoy_dns_cache_envoy_gateway_dfp_cache_v4_preferred_30000ms_default_num_hosts
```

Envoy supports configuring this through DnsCacheConfig.max_hosts, but there does not appear to be a first-class Envoy Gateway API field to configure it through Backend, DynamicResolver, or EnvoyProxy.

We tried using EnvoyPatchPolicy to patch the generated Dynamic Forward Proxy clusters at:

```text
/cluster_type/typed_config/dns_cache_config/max_hosts
```

However, multiple generated clusters share the same DNS cache name:

```text
envoy-gateway-dfp-cache-v4_preferred-30000ms-default
```

Envoy requires every reference to the same DNS cache name to have identical settings. If any generated reference is missed, Envoy rejects the xDS update with:

```text
config specified DNS cache 'envoy-gateway-dfp-cache-v4_preferred-30000ms-default' with different settings
```

This makes EnvoyPatchPolicy fragile for this use case because new DynamicResolver routes can create additional generated clusters that also need the same patch.

Expected behavior:

Envoy Gateway should expose a first-class way to configure Dynamic Forward Proxy DNS cache settings for DynamicResolver backends, especially maxHosts.

For example, as discussed with maintainers, this could be exposed through a field such as dns.maxHosts on ClusterSettings, or another API location that maintainers consider more appropriate.

The configured value should be wired into the generated Envoy DnsCacheConfig consistently for all generated resources sharing the same Dynamic Forward Proxy DNS cache.

[optional Relevant Links:]
https://envoyproxy.slack.com/archives/C03E6NHLESV/p1782805661052069
Maintainer guidance from Slack: Envoy requires every reference to the same DNS cache name to carry identical settings, so partial EnvoyPatchPolicy patches can cause the "different settings" xDS rejection. A first-class API field such as dns.maxHosts on ClusterSettings may be the right fix.

Start by tracing DynamicResolver backends, ClusterSettings, and the generated Dynamic Forward Proxy clusters that share a DNS cache name. Review how Envoy DnsCacheConfig is currently produced and how EnvoyPatchPolicy reaches those resources. Done means a first-class maxHosts setting is exposed and applied consistently to every generated reference sharing the cache.

Written by the indexing model from the issue text.