Optional extProc execution for EnvoyExtensionPolicy target route only

## Problem

`EnvoyExtensionPolicy` currently has no declarative way to **optionally run extProc per request** while keeping behavior strictly scoped to the policy target.

## Scope of this request

This issue is related to, but different from [#9444](https://github.com/envoyproxy/gateway/issues/9444):

- Optional execution should only affect the **explicitly targeted route**.
- It should **not require or imply global/listener-level enablement**.
- No global extProc activation should be introduced for this feature.

## Why this is needed

Users need route-scoped optional extProc execution (for example based on request headers) without broadening activation beyond the targeted route.

## Proposed API direction (aligned with current implementation)

Use/extend the existing `matches` field on `extProc` (instead of introducing a new `when` field) so extProc can be skipped unless request conditions match.

Example intent:

```yaml
extProc:
- backendRefs:
- name: my-ext-proc
port: 9002
matches:
- headers:
- name: x-run-extproc
type: Exact
value: run
```

Expected semantics for this issue:

- `matches` hit: extProc runs.
- `matches` miss: extProc is skipped.
- Omitted `matches`: current always-run behavior for that target remains.
- Scope remains route-targeted only (no listener-global enable).

## Related context

- Broader discussion: [envoyproxy/gateway#9444](https://github.com/envoyproxy/gateway/issues/9444)
- Envoy route-cache/per-route config behavior background: [envoyproxy/envoy#44739](https://github.com/envoyproxy/envoy/issues/44739)

Start by tracing the existing EnvoyExtensionPolicy extProc implementation and its matches field, then review the route-cache and per-route configuration behavior described in the linked Envoy issue. Define completion as matches hits running extProc, misses skipping it, omitted matches preserving current behavior, and no listener-global activation.

Written by the indexing model from the issue text.