GEP: ExtensionRef for TLSRoute

**What would you like to be added**:

Add support for a `filters` field in `TLSRoute.spec.rules[].backendRefs[]`, mirroring the structure already present in HTTPRoute.

Example desired manifest snippet:

```yaml
apiVersion: gateway.networking.k8s.io/v1
kind: TLSRoute
metadata:
name: example
spec:
parentRefs:
- name: my-gateway
hostnames:
- "tenant-app.example.com"
rules:
- backendRefs:
- name: my-tls-service
port: 5432
filters:
- type: ExtensionRef
extensionRef:
group: traefik.io # etc.
kind: Middleware
name: tenant-ip-allowlist
```

**Why this is needed**:

TLSRoute is commonly used for TLS passthrough scenarios (SNI-based routing without termination at the Gateway), which is essential for protocols like gRPC, PostgreSQL, MongoDB, or custom TCP/TLS services where end-to-end encryption is required and decryption at the Gateway is undesirable or impossible. Currently, TLSRoute provides very limited extensibility: no filters are supported at the rule or backend level. This forces users to apply policies (such as IP allowlisting, rate limiting, ...) either Globally on the Gateway (e.g., via loadBalancerSourceRanges or implementation-specific annotations), which breaks multi-tenancy by affecting all routes sharing the Gateway.

HTTPRoute supports filters on backendRefs[] (including ExtensionRef for custom middleware), enabling per-route, per-tenant customization in multi-tenant clusters. Providing the same extension point for TLSRoute brings consistency across route types and unlocks important use cases.

Main use case example:
In a shared Kubernetes cluster, multiple tenants expose internal services via TLS passthrough using TLSRoute. Each tenant needs to restrict access to their service by client IP ranges without modifying the shared Gateway resource (which cluster admins control).

ReferencesIssue: #4654
Discussion: #3635

Traefik IPAllowlist Middleware: https://doc.traefik.io/traefik/middlewares/http/ipallowlist/
Envoy SecurityPolicy: https://gateway.envoyproxy.io/docs/tasks/security/restrict-ip-access/

Start with the GEP overview, then read prerequisite discussion #3635 and related issue #4654 to understand the required consensus. Compare the requested TLSRoute backendRefs filters with the existing HTTPRoute structure. Done means an agreed API design for ExtensionRef support and the corresponding Gateway API changes.

Written by the indexing model from the issue text.