BackendTLSPolicySANValidation conformance test failing on main since at least Aug 3

Description:

TestGatewayAPIConformance/BackendTLSPolicySANValidation has been failing on every main run I checked, going back to at least 2026-08-03. Every PR inherits the failure, so red CI is currently hard to read.

Main runs, all with the same failing test:

run	date	conformance jobs failing on this test
31067661691	08-06	3
31064863693	08-06	2
31059844487	08-06	1
30817198225	08-03	2

The failure splits cleanly by expectation:

--- FAIL: .../valid_BackendTLSPolicy_containing_dns_SAN_should_succeed    (30.00s)
--- PASS: .../mismatched_dns_SAN_should_return_an_HTTP_error
--- FAIL: .../valid_BackendTLSPolicy_containing_uri_SAN_should_succeed    (30.01s)
--- PASS: .../mismatched_uri_SAN_should_return_an_HTTP_error
--- FAIL: .../valid_BackendTLSPolicy_containing_multi_SAN_should_succeed  (30.00s)
--- PASS: .../mismatched_multi_SAN_should_return_an_HTTP_error

Every "valid SAN should succeed" case gets 503 for the whole 30s window (30/30 attempts on both /backendtlspolicy-san-dns and /backendtlspolicy-san-uri):

expected status code to be one of [200], got 503

The mismatch cases pass because they only assert that the request fails, so they would also pass if SAN validation rejected everything.

The BackendTLSPolicy e2e tests look affected too — TestE2E/HTTPRouteMixedProtocols (which applies policy-btls and backend-tls-ca) and TestE2E/HTTPRouteMixedBackends are failing on main and on PR branches in the same runs.

I have not root-caused it, so I am not sure whether the upstream TLS handshake or the SAN matcher is at fault. Filing this so it is tracked, and happy to dig in if nobody is on it already.