Envoy backend: translate AllowPort into egress policy

[ChrisJBurns]

Part of #5900. Follow-up from the Envoy backend review (#5907).

Problem

The Envoy egress backend translates Outbound.AllowHost into :authority RBAC policies but ignores Outbound.AllowPort. Squid enforces AllowPort (via the allowed_ports ACL), so under Envoy an allowlisted host is currently reachable on any port — a loosening of the egress policy versus the default Squid backend.

Task

• Translate AllowPort into the Envoy egress RBAC (e.g. constrain the :authority port component, or add a destination-port matcher) so a host+port allowlist is enforced with parity to Squid.
• Add table tests covering host+port combinations (allowed host on a denied port must be blocked).

Until then

Documented as a Known Limitation in docs/arch/14-envoy-network-proxy.md.