EnvoyProxy CRD validation blocks per-Gateway tracing overrides that rely on merged backendRefs

*Description*:

The CEL validation on `spec.telemetry.tracing.provider` is enforced per-object at admission,
before the GatewayClass-level <-> per-Gateway `mergeType: StrategicMerge` merge runs.

As a result a per-Gateway EnvoyProxy cannot override a single tracing-provider field (e.g. `serviceName`) while inheriting `type` and other fields merged class-level EnvoyProxy.

Expected: the per-Gateway EnvoyProxy is accepted and the host/backendRefs requirement is validated against the merged result, so `type` + `backendRefs` can be defined once on the class-level EnvoyProxy and individual provider fields can be overridden per Gateway.

*Repro steps*:

1. Class-level EnvoyProxy, referenced by GatewayClass.spec.parametersRef:

```
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: EnvoyProxy
metadata: { name: class-proxy, namespace: envoy-gateway-system }
spec:
telemetry:
tracing:
provider:
type: Datadog
backendRefs:
- { group: gateway.envoyproxy.io, kind: Backend, name: datadog-apm, port: 8126 }
```

2. Per-Gateway EnvoyProxy, referenced by Gateway.spec.infrastructure.parametersRef, intending to only override serviceName:

```
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: EnvoyProxy
metadata: { name: gw-proxy, namespace: app-ns }
spec:
mergeType: StrategicMerge
telemetry:
tracing:
provider:
serviceName: my-custom-service
```

3. `kubectl apply` of gw-proxy is rejected:

```
The EnvoyProxy "gw-proxy" is invalid: spec.telemetry.tracing.provider:
Invalid value: "object": no such key: backendRefs evaluating rule:
host or backendRefs needs to be set
```

*Environment*:

* Envoy Gateway v1.8.2 (gateway-helm chart 1.8.2)
* Kubernetes v1.33 (also reproduced on kind v1.36.1)

*Logs*:

N/A

Start with the CEL validation on spec.telemetry.tracing.provider and the StrategicMerge handling described in the issue. Reproduce the rejection with the class-level and per-Gateway EnvoyProxy manifests, then verify that the per-Gateway object is accepted and the host or backendRefs requirement is evaluated against the merged result.

Written by the indexing model from the issue text.