Conditionally run extProc filters based on request headers (add a `when` clause to EnvoyExtensionPolicy)

*Description*:

We want to **conditionally run an `extProc` filter based on request headers** — invoke the external processor only when a request carries (or lacks) a given header, and skip it otherwise. Today an `extProc` in `EnvoyExtensionPolicy` runs for every request on the route/gateway it targets, with no declarative way to gate it.

The obvious workaround — split traffic with `HTTPRoute` header matches and attach the policy only to the "matching" route — is unreliable because of the **frozen filter chain** problem: Envoy builds the filter chain and resolves per-route config from the route matched at the *start* of processing. If the header changes mid-chain (e.g. an earlier routing `ext_proc` returns `clear_route_cache: true`), Envoy re-routes to a new cluster but never re-applies the new route's per-route `ext_proc` enable/disable. See envoyproxy/envoy#44739. The same happens with overlapping/shadowed routes, where the winning route isn't the one the policy is attached to.

**Requested feature:** an optional `when` clause on `extProc` to gate execution on headers declaratively:

```yaml
extProc:
- backendRefs:
- name: my-ext-proc
port: 9002
when: # new, optional
headers:
- name: x-run-extproc
present: true
```

- If `when` matches, the filter runs; otherwise it's skipped.
- Decided per request, independent of which route Envoy selects (not subject to the frozen-filter-chain problem).
- Omitting `when` keeps current behavior (always runs) — backwards compatible.

*Relevant Links*:

- Envoy "frozen filter chain" issue: https://github.com/envoyproxy/envoy/issues/44739

Start by tracing how EnvoyExtensionPolicy handles extProc configuration and review the linked Envoy frozen filter chain issue. Done means an optional when.headers condition gates extProc execution per request, while omitting it preserves current always-run behavior.

Written by the indexing model from the issue text.