fix(xds): don't create empty filter chain for a gateway

[lukidzi]

Motivation

Delegated gateways with transparent proxy enabled were failing with:

  xds.nack-backoff    config was previously rejected by Envoy. Applying backoff before resending it {"reason": "Error adding/updating listener(s) inbound:passthrough:ipv4: error adding listener '0.0.0.0:15006': no filter chains specified\n..."}

The issue occurs when all these conditions are met:

• Delegated gateway (no inbounds defined)
• Transparent proxy enabled
• mTLS with STRICT CA backend mode
• FeatureStrictInboundPorts feature flag enabled (default in newer versions)

In CreateInboundPassthroughListener, the condition if useStrictInboundPorts would enter a loop over proxy.Dataplane.Spec.Networking.Inbound to create per-port filter chains. For delegated gateways with no inbounds, this loop produces zero filter chains, causing Envoy to reject the listener.

Implementation information

• Modified the condition in CreateInboundPassthroughListener from if useStrictInboundPorts to if useStrictInboundPorts && len(proxy.Dataplane.Spec.Networking.Inbound) > 0
• When no inbounds exist, the code now falls through to the else branch which creates a default passthrough filter chain
• Updated the test case to properly cover the delegated gateway scenario with strict mTLS and FeatureStrictInboundPorts enabled

[github-actions]

Reviewer Checklist

🔍 Each of these sections need to be checked by the reviewer of the PR 🔍:
If something doesn't apply please check the box and add a justification if the reason is non obvious.

• Is the PR title satisfactory? Is this part of a larger feature and should be grouped using > Changelog?
• PR description is clear and complete. It Links to relevant issue as well as docs and UI issues
• This will not break child repos: it doesn't hardcode values (.e.g "kumahq" as an image registry)
• IPv6 is taken into account (.e.g: no string concatenation of host port)
• Tests (Unit test, E2E tests, manual test on universal and k8s)
  • Don't forget ci/ labels to run additional/fewer tests
• Does this contain a change that needs to be notified to users? In this case, UPGRADE.md should be updated.
• Does it need to be backported according to the backporting policy? (this GH action will add "backport" label based on these file globs, if you want to prevent it from adding the "backport" label use no-backport-autolabel label)