improve ingress gateway xDS generation handling of proxycfg eventual consistency

In `ResourceGenerator.clustersFromSnapshotIngressGateway` [we loop over](https://github.com/hashicorp/consul/blob/main/agent/xds/clusters.go#L385) the `cfgSnap.IngressGateway.Upstreams` and lookup discovery chains from `cfgSnap.IngressGateway.DiscoveryChain` and fail if the chain is nil. This is problematic because these two things are populated from different blocking queries that respond at different times so in a way it's expected that during config-entry writes occasionally the discovery chain resolution will be guaranteed to be `nil`.

All of these upstream loops should likely be switched to use a helper method that only loops over the upstreams that are "ready" akin to a similar thing done for terminating gateways `cfgSnap.TerminatingGateway.ValidServices()`