UDP upstream source binding and port management

Title: UDP upstream source binding and port management

Description: Envoy currently has several separate UDP source-binding behaviors:

• Native UDP proxy sockets do not honor upstream_bind_config.
• CONNECT-UDP already uses upstream_bind_config.
• use_original_src_ip preserves the downstream source IP, but not its port, and requires transparent-socket privileges and compatible routing.
• Envoy has no configured UDP source-port ranges, reservation tracking, or explicit exhaustion statistics.
• Using SO_REUSEADDR without tuple reservations can create duplicate UDP tuples, allowing a newer socket to shadow an existing one. This work should provide a coherent model for all these cases.

Related issues: #12277, #15590, #32499, #37104, #42220.

Introduce an internal UDP source-binding policy with three modes:

Mode	Source IP	Source port	Socket behavior
Kernel-selected	Selected by kernel routing	Kernel-selected ephemeral port	Connected
Configured	Resolved from upstream_bind_config	Kernel-selected, fixed, or configured range	Connected
Transparent	Downstream peer IP	Kernel-selected by default; optionally preserve downstream port	Currently unconnected

The policy determines:

• the effective source address
• which PREBIND socket options to apply
• whether an explicit bind is required
• whether the socket can be connected
• whether a source-port reservation is required.

The policy would remain as internal abstraction. Existing tcp source-binding behavior and the local-address-selector extension contract remain unchanged.

[optional Relevant Links:]

Any extra documentation required to understand the issue.