HTTPRoute/SecurityPolicy/ListenerSet - StategicMerge setup does not resolve to parent policy

*Description*:
I want to customize HttpRoute with parentRef setup to ListenerSet
However `processSecurityPolicyForRoute` does not handle ListenerSet kind properly and ignore gw policy
https://github.com/envoyproxy/gateway/blob/f8f03704ec24def2970100b76f9a622ed621497c/internal/gatewayapi/securitypolicy.go#L294

*Repro steps*:
```
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
name: oidc
spec:
targetRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: srm-gateway
oidc:
provider:
issuer: https://login.microsoftonline.com/-/v2.0
clientID: -
clientSecret:
name: envoy-client-secret
forwardAccessToken: false
redirectURL: https://kube/oauth2/callback
cookieDomain: kube
cookieNames:
accessToken: EnvoyAccessToken
idToken: EnvoyIdToken
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
name: open-argocd
namespace: argocd
spec:
mergeType: StrategicMerge
targetRefs:
- group: gateway.networking.k8s.io
kind: HTTPRoute
name: argocd
authorization:
defaultAction: Deny
rules:
- name: "allow-jwt-claim"
action: Allow
principal:
jwt:
provider: entra
claims:
- name: roles
valueType: "StringArray"
values:
- "default"
jwt:
providers:
- name: entra
issuer: https://login.microsoftonline.com/-/v2.0
remoteJWKS:
uri: https://login.microsoftonline.com/-/discovery/v2.0/keys
extractFrom:
cookies:
- EnvoyAccessToken
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: argocd
namespace: argocd
spec:
parentRefs:
- name: argocd
namespace: argocd
kind: ListenerSet
hostnames:
- argocd.kube
rules:
- matches:
- path:
type: PathPrefix
value: /
backendRefs:
- name: fleet-argocd-server
port: 80
```

Read internal/gatewayapi/securitypolicy.go around processSecurityPolicyForRoute at line 294, then trace how an HTTPRoute parentRef with kind ListenerSet is resolved for a StrategicMerge SecurityPolicy. Reproduce the behavior with the supplied SecurityPolicy and HTTPRoute manifests; done means the open-argocd policy is applied instead of being ignored.

Written by the indexing model from the issue text.