Support per-Actor egress gateway configuration

[EItanya]

Summary

Allow each Actor to select the egress gateway that handles its outbound traffic. This lets Actors in the same Substrate deployment use different policy enforcement gateways, including user-managed gateways.

This tracks gateway selection independently of the egress rules enforced for an Actor.

Tracked by #1325 (Egress policy readiness).
Related: #430 (Pluggable Egress Support).

[mikemorris]

I think this is just a phrasing issue, but from RBAC perspective I would expect specific Actors or all Actors originated from a given ActorTemplate should be assigned to egress gateways - an Actor shouldn't be able to autonomously decide to use a different (perhaps more permissive) egress PEP.

[LiorLieberman]

We need to fix it before GA.

This flag should not really be a thing, its weird. However if we move it on per-actor/atespace (which I like), it brings another consideration that now actor owner can override it to whatever thing they want..?

Whats the smartest smallest thing we can do before GA? one fallback can be to prefix the flag with --experimental-to-be-removed-{flag-name}.. but obvs dont love that

cc: Eitan Yarmush (@EItanya) Benjamin Elder (@BenTheElder) Bowei Du (@bowei) haiyanmeng Keith Mattix II (@keithmattix)

[haiyanmeng]

Discussion on Slack: https://cloud-native.slack.com/archives/C0B6M3E2J3D/p1789756234430039