fix: handle missing generic L7 metadata entries

[immanuwell]

generic l7_proto enforcement in cilium.network assumes dynamicMetadata().filter_metadata()[l7proto] is always there.
when that namespace is missing, onData() hits .at(l7proto_) and throws. not great.

this treats the missing namespace as empty metadata and keeps the policy path running. also adds a small regression test.

repro

1. configure a generic l7_proto policy with metadata_rule
2. hit cilium.network::onData() before any filter writes dynamicMetadata().filter_metadata()[l7proto]
3. current code throws on .at(l7proto_)

note: i couldnt run bazel test //tests:network_filter_test here, local bazel gets stuck earlier on a rules_foreign_cc toolchain bootstrap failure.

[nezdolik]

@immanuwell please fix ci checks

[immanuwell]

@nezdolik fixed all CI checks, and switched to peer-class approach you suggested