l7policy: guard null upstream socket addresses when encoding local replies #2063

Summary

In Cilium::AccessFilter::encodeHeaders, the connection-close handling checks that stream_info.upstreamInfo() exists, then dereferences upstreamRemoteAddress() and upstreamLocalAddress() without checking those address pointers. Upstream information can exist before an upstream socket has been established, leaving its socket addresses null.

The affected address comparison is present on current main.

Synthetic filter-level reproduction

1. Construct a downstream AccessFilter with a valid downstream connection and HTTP/1.1 stream.
2. Set upstream info to a default-constructed StreamInfo::UpstreamInfoImpl, leaving its local and remote socket addresses null.
3. Call encodeHeaders with :status: 503 and connection: close.

The current code enters the same-tuple comparison and dereferences a null upstream address. The same problem exists when only one of the upstream addresses is missing.

Expected behavior

The filter should continue encoding the local response without performing the socket-tuple comparison when addresses are unavailable. When all addresses are present and the tuples match, it should retain the existing downstream connection-drain behavior.

I am preparing a PR with the address guard and synthetic unit cases. Local C++ validation remains pending because the available Docker builder failed before compilation.