Treat every same-port SDS peer as overlapping

Reported by Codex:

Treat every same-port SDS peer as overlapping

When the SDS listener has an explicit hostname, this loop only downgrades non-SDS peers whose known SAN overlaps that hostname. However the SDS certificate's SANs are the opaque part, and EG does not require the served cert to contain only the listener hostname; an SDS server for `sds.example.com` can return a cert that also covers `foo.example.com`. In that configuration a client can open an h2 connection to the SDS listener and coalesce `foo.example.com` requests onto it, while the `foo.example.com` listener remains on h2 because its SANs do not match `sds.example.com`. Any same-port peer of a valid SDS-backed HTTPS listener should be treated as overlapping unless ALPN is explicitly configured.

Useful? React with 👍 / 👎.

_Originally posted by @chatgpt-codex-connector[bot] in https://github.com/envoyproxy/gateway/pull/9525#discussion_r3725624666_

Locate the SDS listener loop described in the issue and trace how same-port peers are classified when the listener has an explicit hostname. Verify the behavior for a valid SDS-backed HTTPS listener with no explicit ALPN and for peers with overlapping or non-overlapping SANs. Done means every same-port peer is treated as overlapping unless ALPN is explicitly configured, with regression coverage for the described coalescing case.

Written by the indexing model from the issue text.