fix(telemetry): support BackendTLSPolicy for telemetry backends

[codefromthecrypt]

What type of PR is this?
fix(telemetry): support BackendTLSPolicy for telemetry backends

What this PR does / why we need it:
processBackendRefs does not look up BackendTLSPolicy for telemetry backends (access logs, tracing, metrics), so TLS can only be configured via Backend.spec.tls.

Replace inline processServerValidationTLSSettings with applyBackendTLSSetting so telemetry backends get the full Backend + BackendTLSPolicy + EnvoyProxy TLS merge.

Which issue(s) this PR fixes:
Workaround: envoyproxy/ai-gateway#1964

Release Notes: Yes

Tested with examples/otel-headers against Elastic Cloud using BackendTLSPolicy (no Backend.spec.tls):

--- a/examples/otel-headers/resources/gateway.yaml
+++ b/examples/otel-headers/resources/gateway.yaml
@@ -5,15 +5,21 @@
 spec:
   endpoints:
     - fqdn:
-        hostname: localhost
-        port: 4317
-# Use below for cloud OTLP endpoints
-#   endpoints:
-#     - fqdn:
-#         hostname: otel.example.com
-#         port: 443
-#   tls:
-#     wellKnownCACertificates: System
+        hostname: adrian-o11y-b7e5ce.ingest.us-central1.gcp.elastic.cloud
+        port: 443
+---
+apiVersion: gateway.networking.k8s.io/v1alpha3
+kind: BackendTLSPolicy
+metadata:
+  name: otel-tls
+spec:
+  targetRefs:
+    - group: gateway.envoyproxy.io
+      kind: Backend
+      name: otel-collector
+  validation:
+    wellKnownCACertificates: System
+    hostname: adrian-o11y-b7e5ce.ingest.us-central1.gcp.elastic.cloud
 ---
@@ -35,7 +41,7 @@
             headers:
               - name: Authorization
-                value: Bearer fake
+                value: ApiKey <redacted>

[netlify]

✅ Deploy Preview for cerulean-figolla-1f9435 canceled.

Name	Link
🔨 Latest commit	f9e5061
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/69cc5ae05084f60008f508cc

[codecov]

Codecov Report

❌ Patch coverage is 90.47619% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 74.36%. Comparing base (fdc3128) to head (f9e5061).
⚠️ Report is 12 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/gatewayapi/listener.go	90.47%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8545      +/-   ##
==========================================
- Coverage   74.40%   74.36%   -0.04%     
==========================================
  Files         243      243              
  Lines       38262    38267       +5     
==========================================
- Hits        28467    28457      -10     
- Misses       7805     7816      +11     
- Partials     1990     1994       +4     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[zhaohuabing]

LGTM. Thanks!

[zirain]

/retest