EnvoyFilter: implement targetRefs (#3160)

This is the only API we have a `selector` without `targetRef`.

The motivation at the time was that waypoints don't official support
EnvoyFilter, and targetRef was primarily for waypoints.

However, targetRef can be used with all Kubernetes Gateway, including
for ingress, where EnvoyFilter is supported. Also, long term it will
support waypoint as well I assume; the earlier we add the field the less
migration pain there is.

This PR goes directly to `targetRefs` in line with
#3159.

Author: howardjohn