The TLS cipher settings for ClientTrafficPolicy do not support equal-preference groups.

*Description*:
In version 1.7.x, I enabled TLS 1.1 by modifying the default cipher suites listed in the [documentation](https://gateway.envoyproxy.io/docs/api/extension_types/#clienttlssettings).
After upgrading to version 1.8.3, the TLS ciphers defined in the `ClientTrafficPolicy` became invalid.
The error message reads:
```
TLS: unsupported cipher suite: [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]
```

*Repro steps*:
1. Create the following policy：
```yaml
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: ClientTrafficPolicy
metadata:
name: eg
spec:
tls:
# To maintain compatibility with okhttp 2.X, downgrade to HTTP/1.1.
alpnProtocols:
- http/1.1
minVersion: "1.1"
ciphers:
- '[ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]'
- '[ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305]'
- ECDHE-ECDSA-AES256-GCM-SHA384
- ECDHE-RSA-AES256-GCM-SHA384
# Due to the need to support Windows Server 2008, it is necessary to enable TLS 1.1.
- ECDHE-ECDSA-AES128-SHA
- ECDHE-RSA-AES128-SHA
targetRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: eg
```
2. Run `kubectl describe ClientTrafficPolicy eg`

*Environment*:
Envoy Gateway 1.8.3

*Logs*:
```
Status:
Ancestors:
Ancestor Ref:
Group: gateway.networking.k8s.io
Kind: Gateway
Name: eg
Namespace: default
Conditions:
Last Transition Time: 2026-08-06T04:10:03Z
Message: TLS: unsupported cipher suite: [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]
TLS: unsupported cipher suite: [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]
TLS: unsupported cipher suite: [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]
TLS: unsupported cipher suite: [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]
TLS: unsupported cipher suite: [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]
TLS: unsupported cipher suite: [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]
TLS: unsupported cipher suite: [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305].
Observed Generation: 9
Reason: Invalid
Status: False
Type: Accepted
Controller Name: gateway.envoyproxy.io/gatewayclass-controller
```

*Mitigation Solution*
Separate ciphers that in the equal-preference groups:
```yaml
ciphers:
- ECDHE-ECDSA-AES128-GCM-SHA256
- ECDHE-ECDSA-CHACHA20-POLY1305
- ECDHE-RSA-AES128-GCM-SHA256
- ECDHE-RSA-CHACHA20-POLY1305
```

Start by reproducing the ClientTrafficPolicy example and trace how its TLS ciphers are validated, focusing on equal-preference groups written with the `|` separator. Compare that behavior with the documented syntax and the separate-cipher mitigation. Done means the grouped cipher values are accepted without an Invalid status while existing cipher validation remains intact.

Written by the indexing model from the issue text.