Support UDPRoute in SecurityPolicy for client IP allowlist/denylist

*Description*:

`SecurityPolicy` can currently target `Gateway`, `ListenerSet`, `HTTPRoute`, `GRPCRoute` and `TCPRoute`. When it targets a `TCPRoute`, client-IP CIDR based authorization is supported, which gives users an allowlist/denylist for L4 TCP traffic.

`UDPRoute` is not an allowed target, so there is no equivalent way to restrict which clients may reach a UDP service exposed through the Gateway.

This is a common need for the kinds of workloads people put behind a UDP listener — DNS, syslog, NTP, metrics/telemetry collectors, game servers, VoIP/RTP — where the service is typically meant to be reachable only from a known set of networks (branch offices, partner ranges, monitoring subnets) rather than from the whole internet.

Request: allow `SecurityPolicy` to target `UDPRoute`, with the same client-IP CIDR authorization semantics that already exist for `TCPRoute`. Users would then have one consistent policy model for L4 access control regardless of whether the route is TCP or UDP.

Related to: https://github.com/envoyproxy/gateway/issues/7825

Start by finding the SecurityPolicy target validation and the existing TCPRoute client-IP CIDR authorization path, then trace the corresponding UDPRoute handling and its tests. Done means UDPRoute is accepted as a target and the same allowlist/denylist behavior is covered for UDP traffic without changing existing targets.

Written by the indexing model from the issue text.