fix: handle missing generic L7 metadata entries

[immanuwell]

generic l7_proto enforcement in cilium.network assumes dynamicMetadata().filter_metadata()[l7proto] is always there.
when that namespace is missing, onData() hits .at(l7proto_) and throws. not great.

this treats the missing namespace as empty metadata and keeps the policy path running. also adds a small regression test.

repro

1. configure a generic l7_proto policy with metadata_rule
2. hit cilium.network::onData() before any filter writes dynamicMetadata().filter_metadata()[l7proto]
3. current code throws on .at(l7proto_)

note: i couldnt run bazel test //tests:network_filter_test here, local bazel gets stuck earlier on a rules_foreign_cc toolchain bootstrap failure.

[nezdolik]

why is this needed? if you need access to private member fields to validate in test, consider declaring friend peer class, e.g. https://github.com/cilium/proxy/blob/main/cilium/grpc_subscription.h#L67 and then define accessor methods in test file (network_filter_test.cc) like so

proxy/tests/cilium_test_peer.h

Line 17 in 7cffc77

class CiliumTestPeer {

[nezdolik]

@immanuwell please fix ci checks