policy: Deduplicate SecretWatchers and TLS contexts

[jrajahalme]

Network policies may contain hundreds or thousands of HeaderMatch or TLS rules referring to a small set of Secrets. Each reference previously constructed a separate SecretWatcher or Envoy TLS ContextConfigImpl, including its SDS provider callbacks and other context state.

Add separate weak caches for SecretWatchers and upstream and downstream TLS contexts, keyed by the SDS name or Cilium TLSContext protobuf, respectively. Reuse a live context when an equivalent policy configuration is encountered.

Reset the caches together with the policy maps after an NPDS stream restart, preserving the existing agent-restart behavior. Prune expired cache entries asynchronously after policy updates and worker quiescence, keeping pruning off the policy-update hot path.

Benchmark an NPDS update containing 1,000 policies that reference the same SDS-derived CA validation context. The CA is delivered through a real dynamic SDS provider rather than embedded in the policy TLS contexts.

Optimized benchmark results (3 repetitions):

                                CPU time     Retained heap     Heap/policy
  TLS context cache enabled     1.47 ms      1.581 MiB         1.619 KiB
  TLS context cache disabled    3.95 ms      4.990 MiB         5.109 KiB

This reduces CPU time by approximately 63% and retained heap by 68%, saving about 3.41 MiB per 1,000-policy update and increasing throughput by 2.68x.

The benchmark uses Envoy's small, single-certificate test CA. Production SDS resources commonly contain larger CA bundles comparable to those shipped with operating systems, so the benchmark likely understates the memory impact of retaining duplicate certificate-related context state.

Benchmark results for deduplication of SecretWatchers on HeaderMatches are more modest (duplicating header sized secrets carries less overhead), but are still positive around 20-25% for CPU and memory.

[jrajahalme]

added a missing include for tidy

[jrajahalme]

restarted integration test due to a flake fixed by #2007