feat: allow h2 in ALPN

[savme]

Envoy Gateway offers only http/1.1 on listeners whose certificates overlap, which includes every managed hostname under the wildcard certificate. Clients there can't negotiate HTTP/2, so gRPC over TLS fails: grpc-go refuses to connect without h2 agreed in the handshake.

gateway.downstreamClientTraffic now takes alpnProtocols, which the operator writes into each downstream gateway's ClientTrafficPolicy as tls.alpnProtocols. Envoy Gateway keeps an explicit list even where certificates overlap. Only the ALPN list is written, so none of Envoy Gateway's other TLS settings reach every tenant's listener. Unset or empty writes no tls section, since an empty list would turn ALPN off, and an unknown protocol fails the config check.

Test plan

• Config: alpnProtocols decodes, an empty list writes nothing, an unknown protocol is refused
• Envtest: only tls.alpnProtocols is written
• Staging, with the policy this writes applied by hand to one listener on both edges: the managed hostname negotiated h2 and served HTTP/2 200, HTTP/3 was kept, and a neighbouring hostname stayed http/1.1

Note: Offering h2 lets clients reuse one managed hostname's HTTP/2 connection for another, so this depends on misdirected request handling.

Depends on #659

Related to datum-cloud/compute#490