fix: pin consistent-hash clients across weighted backendRefs

[guanchzhou]

What this PR does

Makes ConsistentHash load balancing pin a client to a single backend when a route splits traffic across multiple weighted backendRefs.

Problem

When a route has more than one weighted backend that needs a cluster-per-setting (e.g. per-backendRef filters, mixed endpoint types, weighted zones), Envoy Gateway renders the split as a weighted_clusters route action. The cluster selection among those weighted clusters is random per request. A route-level hash_policy (built from a ConsistentHash load balancer) only makes endpoint selection sticky within the chosen cluster — it does not govern which weighted cluster is picked. So with a canary/primary-backup split, a client can land on backend A for one request and backend B for the next, defeating consistent hashing.

Envoy exposes WeightedCluster.use_hash_policy: "If set, the router will use the request's hash policy to select the cluster." Envoy Gateway never set it.

Fixes #9626.

Change

In buildXdsRoute, after the route hash_policy is built, set use_hash_policy on the weighted clusters when the route action is a weighted_clusters action and a hash policy is present:

if wc := router.GetRoute().GetWeightedClusters(); wc != nil && len(router.GetRoute().GetHashPolicy()) > 0 {
    wc.RandomValueSpecifier = &routev3.WeightedCluster_UseHashPolicy{
        UseHashPolicy: wrapperspb.Bool(true),
    }
}

Gated on a hash policy being present, so weighted routes without a ConsistentHash load balancer are unaffected (their cluster selection stays random-by-weight, as before).

Testing

• New fixture http-route-weighted-backend-consistent-hash — a weighted split across two backends (cluster-per-setting via per-backend filters) with a header-based ConsistentHash LB. The generated route now carries useHashPolicy: true alongside the hashPolicy.
• The existing http-route-weighted-zones golden updated: only the route that has both a ConsistentHash LB and weighted clusters gains useHashPolicy: true; weighted routes without a hash policy are untouched — demonstrating the gating.

go build ./...                          # ok
go test ./internal/xds/...              # ok
gofmt -l / go vet                       # clean

[netlify]

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Name	Link
🔨 Latest commit	648587c
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/6a6c8cddbf6e390008561cca
😎 Deploy Preview	https://deploy-preview-9629--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.06%. Comparing base (b710dd4) to head (648587c).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9629      +/-   ##
==========================================
+ Coverage   76.04%   76.06%   +0.02%     
==========================================
  Files         259      259              
  Lines       43275    43278       +3     
==========================================
+ Hits        32907    32919      +12     
+ Misses       8178     8170       -8     
+ Partials     2190     2189       -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.