fix: set SchemeHeaderTransformation.MatchUpstream on AI Gateway listeners (#2194)

**Description**

Azure is strict about `scheme` header to be same as the TLS transport on
which the request is being made. If the listener is an http listener,
envoy forwards a request with `scheme: http` instead of `https`. This
leads to requests getting dropped.
The simple solution is to use `matchUpstream` which is what is being
done in MCP backend listeners but missed in regular AI gateway route
listeners.

**Related Issues/PRs (if applicable)**
Fixes #2095

Signed-off-by: Anurag Aggarwal <kanurag94@gmail.com>

Author: kanurag94

internal/extensionserver/post_translate_modify.go

@@ -676,6 +676,10 @@ func (s *Server) insertRouterLevelAIGatewayExtProc(listener *listenerv3.Listener
 		if err = insertAIGatewayExtProcFilter(httpConManager, extProcFilter); err != nil {
 			return fmt.Errorf("failed to insert AI Gateway extproc filter: %w", err)
 		}
+		// Match the :scheme pseudo-header to the upstream transport protocol.
+		httpConManager.SchemeHeaderTransformation = &corev3.SchemeHeaderTransformation{
+			MatchUpstream: true,
+		}
 		hcAny, err := toAny(httpConManager)
 		if err != nil {
 			return fmt.Errorf("failed to marshal updated HCM to Any: %w", err)

internal/extensionserver/post_translate_modify_test.go

@@ -340,6 +340,29 @@ func Test_shouldAIGatewayExtProcBeInserted(t *testing.T) {
 	}
 }
 
+func TestServer_insertRouterLevelAIGatewayExtProc_setsSchemeHeaderTransformation(t *testing.T) {
+	hcm := &httpconnectionmanagerv3.HttpConnectionManager{
+		HttpFilters: []*httpconnectionmanagerv3.HttpFilter{{Name: wellknown.Router}},
+	}
+	listener := &listenerv3.Listener{
+		DefaultFilterChain: &listenerv3.FilterChain{
+			Filters: []*listenerv3.Filter{
+				{
+					Name:       wellknown.HTTPConnectionManager,
+					ConfigType: &listenerv3.Filter_TypedConfig{TypedConfig: mustToAny(t, hcm)},
+				},
+			},
+		},
+	}
+	s := &Server{log: zap.New()}
+	require.NoError(t, s.insertRouterLevelAIGatewayExtProc(listener))
+
+	updatedHCM, _, err := findHCM(listener.DefaultFilterChain)
+	require.NoError(t, err)
+	require.True(t, updatedHCM.GetSchemeHeaderTransformation().GetMatchUpstream(),
+		"SchemeHeaderTransformation.MatchUpstream must be true so :scheme matches upstream TLS transport")
+}
+
 func Test_findListenerRouteConfigs(t *testing.T) {
 	newHCM := func(name string) *httpconnectionmanagerv3.HttpConnectionManager {
 		return &httpconnectionmanagerv3.HttpConnectionManager{