Description:

Add shadowMode to RateLimitRule in EnvoyGateway’s RateLimit API (e.g., BackendTrafficPolicy.spec.rateLimit.global.rules[].shadowMode).
When shadowMode: true, the rule is evaluated and reported but never enforces 429. EnvoyGateway should translate this directly to envoyproxy/ratelimit’s per-descriptor shadow_mode. This enables safe dry-runs and tuning before turning limits on.

Relevant Links:

https://github.com/envoyproxy/ratelimit#shadowmode