[waypoint] Support sending from Ingress to Waypoint

[stevenctl]

Istio will only send to the waypoint if the destination address is a service VIP (ClusterIP for k8s service, addresses for ServiceEntry). When we have north south traffic like client -> kgateway -> svc, we resolve svc into endpoint addresses, so the waypoint is skipped. We need a setting that tells kgateway to send to svc without resolving endpoints.

Istio does this using an env var INGRESS_USE_WAYPOINTS on istiod to enable the feature in general, AND a label on Service that triggers the behavior istio.io/ingress-use-waypoint. We should respect that label, and possibly add a Setting/env to gate it.

https://github.com/istio/istio/blob/e650d24eda30618bc2d188f57693cea21d10f297/pilot/pkg/features/ambient.go#L60

Side note: this topic is an open question in gateway-api: kubernetes-sigs/gateway-api#1478