Add Gateway API UDPRoute support for datagram forwarding

[Shine-neko]

Adds Gateway API UDPRoute: forward a whole UDP listener port to backends. The datagram twin of the TCPRoute shipped in #130.

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
spec:
  gatewayClassName: sozune
  listeners:
    - name: dns
      protocol: UDP
      port: 53
---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: UDPRoute
spec:
  parentRefs:
    - name: udpgw
      sectionName: dns
  rules:
    - backendRefs:
        - name: coredns
          port: 53

Design

A near-exact copy of TCPRoute, differing only where UDP does: Protocol::Udp entrypoints, listener_serves_udp (protocol UDP), and resolution against proxy.udp listeners instead of proxy.tcp. Same watcher / apply / delete / re-resolve shape, same catch-all-per-rule model, same static-port requirement (the Gateway's UDP listener port must match a proxy.udp entry). Reuses tls_entrypoint_defaults, the ParentRef trait, and the shared status machinery. The ReferenceGrant filter now recognises UDPRoute alongside the other three kinds.

Verified on a real cluster

Built into an image and run on kind end to end: the k8s suite (tests/e2e/k8s/05-udproute.sh) installs the UDPRoute CRD, stands up a socat UDP echo backend, and asserts the datagram port is forwarded (k8s-udproute-ok comes back). 46/46 in the k8s suite, 128/128 on the Docker suite (no regression), plus 6 new unit tests.

Review

Codex confirmed it's a faithful copy — distinct k8s-gateway-udp/ id prefix (no collision with tcp/tls/http), backends/weight/ReferenceGrant handling faithful to TCP, no protocol-string crossover, correct SCOPE_SUBSCRIBERS = 4, clean factory wiring.

The one point it raised is the pre-existing ReferenceGrant kind-blindness carried over from #130: grants are keyed by (from_ns, to_ns) without the route kind, so a grant for one kind admits another in the same namespace. Documented on allows_backend_ref (now mentioning UDPRoute too) and left for the dedicated Gateway API hardening pass, not widened into this PR.