feat(egress): implement PRD 0053 — DLP addon with Gateway API matches

Replace path_allowlist with Gateway API HTTPRoute match vocabulary
(paths, methods, headers with AND/OR semantics) and add DLP scanning
to the egress proxy:

- Token pattern detection (AWS, GitHub, Anthropic, OpenAI, Stripe, JWT)
- Known secret detection (EGRESS_TOKEN_* with base64/URL/hex variants)
- Naive prompt injection detection (disclosure + credential, jailbreak)
- Per-route DLP configuration via manifest dlp block
- Inbound response scanning with block/warn severity

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/unit/test_plan_print_parity.py

@@ -67,14 +67,12 @@ def _egress_plan(tmp: str) -> EgressPlan:
         routes=(
             EgressRoute(
                 host="api.example.com",
-                path_allowlist=("/v1/",),
                 auth_scheme="bearer",
                 token_env="EGRESS_TOKEN_0",
                 token_ref="TOKEN",
             ),
             EgressRoute(
                 host="static.example.com",
-                path_allowlist=("/",),
             ),
         ),
         token_env_map={"EGRESS_TOKEN_0": "TOKEN"},