BackendTLSPolicySANValidation conformance test failing on main since at least Aug 3

*Description*:

`TestGatewayAPIConformance/BackendTLSPolicySANValidation` has been failing on every `main` run I checked, going back to at least 2026-08-03. Every PR inherits the failure, so red CI is currently hard to read.

Main runs, all with the same failing test:

| run | date | conformance jobs failing on this test |
|---|---|---|
| [31067661691](https://github.com/envoyproxy/gateway/actions/runs/31067661691) | 08-06 | 3 |
| [31064863693](https://github.com/envoyproxy/gateway/actions/runs/31064863693) | 08-06 | 2 |
| [31059844487](https://github.com/envoyproxy/gateway/actions/runs/31059844487) | 08-06 | 1 |
| [30817198225](https://github.com/envoyproxy/gateway/actions/runs/30817198225) | 08-03 | 2 |

The failure splits cleanly by expectation:

```
--- FAIL: .../valid_BackendTLSPolicy_containing_dns_SAN_should_succeed (30.00s)
--- PASS: .../mismatched_dns_SAN_should_return_an_HTTP_error
--- FAIL: .../valid_BackendTLSPolicy_containing_uri_SAN_should_succeed (30.01s)
--- PASS: .../mismatched_uri_SAN_should_return_an_HTTP_error
--- FAIL: .../valid_BackendTLSPolicy_containing_multi_SAN_should_succeed (30.00s)
--- PASS: .../mismatched_multi_SAN_should_return_an_HTTP_error
```

Every "valid SAN should succeed" case gets `503` for the whole 30s window (30/30 attempts on both `/backendtlspolicy-san-dns` and `/backendtlspolicy-san-uri`):

```
expected status code to be one of [200], got 503
```

The mismatch cases pass because they only assert that the request fails, so they would also pass if SAN validation rejected everything.

The BackendTLSPolicy e2e tests look affected too — `TestE2E/HTTPRouteMixedProtocols` (which applies `policy-btls` and `backend-tls-ca`) and `TestE2E/HTTPRouteMixedBackends` are failing on main and on PR branches in the same runs.

I have not root-caused it, so I am not sure whether the upstream TLS handshake or the SAN matcher is at fault. Filing this so it is tracked, and happy to dig in if nobody is on it already.

Start with TestGatewayAPIConformance/BackendTLSPolicySANValidation and reproduce the valid DNS, URI, and multi-SAN cases alongside their mismatch cases. Compare the SAN validation and upstream TLS-handshake behavior, then check the related TestE2E/HTTPRouteMixedProtocols and TestE2E/HTTPRouteMixedBackends failures. Done means the valid SAN cases return 200 and the affected e2e tests pass on main and PR runs.

Written by the indexing model from the issue text.