Match HTTPRoutes on headers, query params, and method

[Shine-neko]

Summary

The Gateway API provider only honored matches[].path — a rule's headers, queryParams, and method conditions were ignored, so a route meant to match only GET requests carrying X-Canary: yes was served for every request on its hostname. This wires those three match dimensions through to the entrypoint model.

What changed

• Header / query / method matching — matches[].headers[], matches[].queryParams[], and matches[].method are now translated in rule_to_entrypoints. Within a match they are ANDed with the path (and each other); across matches they stay ORed (each match already fans out into its own entrypoint).
• Model reuse — no new model fields. These map onto the existing match_headers / match_query / methods on EntrypointConfig, the same fields the Docker/label and YAML providers already populate, so enforcement is shared: header/query are checked by the request-match middleware (404 on a miss), methods are enforced natively by Sōzu (one frontend per verb).
• Regex rejection — header/query type: RegularExpression has no faithful representation in the exact/presence model. Rather than serve the route with the regex condition silently dropped (routing more traffic than the author asked for), the whole route is rejected with ResolvedRefs=False reason=UnsupportedValue, mirroring how unsupported filters are handled. Exact and presence-only header/query matches, and all nine method verbs, are supported.
• New gateway_matches.rs module holds the pure translators + the unsupported-condition check, alongside the existing gateway_filters.rs.

Tests

• 10 new unit tests: exact header/query become match conditions, method becomes an uppercase verb, all three ANDed on one match, regex header/query reported unsupported, exact matches not reported unsupported.
• e2e (02-gateway.sh + gateway-manifests.yaml): a header+method route serves only a GET with X-Canary: yes (200) and 404s a GET without the header and a POST with it; a query-param route serves only ?debug=1. Verified end-to-end on kind against a local image build: 33 passed, 0 failed.
• cargo fmt --check, clippy clean; full unit suite 686 passed.

Docs

HTTPRoute support list in the Kubernetes provider docs updated with the new match dimensions and the regex-rejection behavior.