Support HTTP/2 keepalive in DestinationRule

[mpuncel]

🤖 Draft PR from AI agent.

Summary

• Adds DestinationRule API support for connectionPool.http.http2ProtocolOptions.connectionKeepalive.interval/timeout via a temporary istio.io/api replace to mpuncel/api.
• Maps the new setting onto Envoy HTTP/2 connection_keepalive for upstream clusters that are already configured as HTTP/2.
• Validates that interval and timeout are present and valid durations when connectionKeepalive is set.
• Updates generated CRDs, validation fixtures, tests, and release notes.

Notes

• This draft is for review in the fork first. Before this can be made upstreamable, the matching istio/api change needs to be merged or otherwise replaced with an official istio.io/api pseudo-version, and the temporary fork replace should be removed.

Tests

• go test ./pilot/pkg/networking/core
• go test ./pkg/config/validation
• git diff --check