fix: Add allow_mode_override to ext_proc filters in envoy template

Enables dynamic body buffering for plugins that declare BodyAccess
(e.g., mcp-parser). Without this flag, Envoy silently ignores the
ModeOverride in ext_proc responses and never forwards the request body,
causing "Spurious response message" warnings and broken connections.

See rossoctl/cortex#362 for the corresponding authbridge fix.

Signed-off-by: Hai Huang <hai@us.ibm.com>
Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Hai Huang <huang195@gmail.com>

Author: huang195

kagenti-operator/internal/webhook/injector/envoy.yaml.tmpl

@@ -42,6 +42,7 @@ static_resources:
                 envoy_grpc:
                   cluster_name: ext_proc_cluster
                 timeout: 30s
+              allow_mode_override: true
               processing_mode:
                 request_header_mode: SEND
                 response_header_mode: SKIP
@@ -91,6 +92,7 @@ static_resources:
                 envoy_grpc:
                   cluster_name: ext_proc_cluster
                 timeout: 30s
+              allow_mode_override: true
               processing_mode:
                 request_header_mode: SEND
                 response_header_mode: SKIP