Backport of [NET-4703] Prevent partial application of Envoy extensions into release/1.16.x

[hc-github-team-consul-core]

Backport

This PR is auto-generated from #18068 to be assessed for backporting due to the inclusion of the label backport/1.16.

The below text is copied from the body of the original PR.

---

Ensure that non-required extensions do not change xDS resources before exiting on failure by cloning proto messages prior to applying each extension.

Also avoid unnecessary cloning by moving CanApply checks up a layer and making them before application is attempted.

Description

Today, it's theoretically possible that a non-required extension could fail partway through making updates. If that extension is not configured as Required, we will not short-circuit xDS updates; the error will be logged and swallowed, allowing any other extensions to continue applying before updating xDS resources.

By proactively cloning resources that are subject to extensions, s.t. we do not pass any data by reference that is intended to be modified atomically, we can prevent the unintentional partial application of extensions regardless of their Required status.

Testing & Reproduction steps

• Added tests that use a faulty extension to make changes, then fail, and verify that those changes are not retained
• Added tests for newly promoted CanApply check to ensure we skip application when extensions should not be applied
• Added tests for new Clone method of IndexedResources

PR Checklist

• updated test coverage
• external facing docs updated
• appropriate backport labels added
• not a security concern

---

Overview of commits

• a920c71

[github-team-consul-core-pr-approver]

Auto approved Consul Bot automated PR