ClientTrafficPolicy: option to emit Retry-After header on rate-limit 429 responses

*Description*:

Envoy's rate-limit filters now support `enable_retry_after_header` (filter-wide, both global and local — [envoyproxy/envoy#46289](https://github.com/envoyproxy/envoy/pull/46289)), emitting `Retry-After` on 429s only, clamped to ≥1s, sourced from the same reset value used for `x-ratelimit-reset`.

Propose exposing this as `ClientTrafficPolicy.spec.headers.enableRetryAfterHeader` (bool, default `false` when unset), mirroring the existing `disableRateLimitHeaders`, wired to the same field on both filters.

```yaml
spec:
headers:
enableRetryAfterHeader: true
```

No further upstream Envoy work needed — this is a CRD + translator change only.

Per-rule override (mirroring `xRateLimitHeaders`, #8279) is tracked separately in #9078, pending further upstream Envoy work.

Start by locating the ClientTrafficPolicy CRD definition and the translator handling disableRateLimitHeaders, then trace how the global and local rate-limit filters are configured. Add the headers option with an unset default of false and wire it to both filters; done means the generated configuration enables Retry-After for 429 responses in both cases.

Written by the indexing model from the issue text.