fix(gatewayapi): correctly handle invalid backendRefs

[michaelbeaumont]

The idea here is to configure a reference to a cluster that doesn't exist and let Envoy return a 500 error.

A different option would be to mark a backend explicitly as missing endpoints, as opposed to a special tag value:

backends:
  - unresolvedEndpoints: true
  - destination:
      kuma.io/service: some-working-backend

Changelog: fix(GatewayAPI): correctly handle invalid backendRefs

Checklist prior to review

• Link to relevant issue as well as docs and UI issues -- Closes Gateway API v0.5.0 conformance #4597
• This will not break child repos: it doesn't hardcode values (.e.g "kumahq" as a image registry) and it will work on Windows, system specific functions like syscall.Mkfifo have equivalent implementation on the other OS --
• Tests (Unit test, E2E tests, manual test on universal and k8s) --
• Do you need to update UPGRADE.md? --
• Does it need to be backported according to the backporting policy? --
• Do you need to explicitly set a > Changelog: entry here or add a ci/ label to run fewer/more tests?

[lahabana]

LGTM though I'm a little surprised such a value is accepted as a tag value.

[michaelbeaumont]

LGTM though I'm a little surprised such a value is accepted as a tag value.

Yeah, you're right. It's because we validate destination as selectors, not tags, and selectors can contain slashes. Perhaps especially kuma.io/service should be more strictly validated here, it doesn't make sense for it to be *, for example.

[michaelbeaumont]

I'm going to merge this. We can potentially discuss validation later