fix: clone RouteBaseDirectives before per-policy append (#246)

[ecv]

What

getCorazaDirectivesForTrafficProtectionPolicy seeded its per-policy directive list by aliasing the shared RouteBaseDirectives slice, then appended to it. With spare capacity (cap > len) the append writes into the shared backing array — per-policy directives leak into the base seen by other policies.

Fix

directives := slices.Clone(r.Config.Gateway.Coraza.RouteBaseDirectives)

Defensive copy before appending, matching the existing safe precedent at internal/extensionserver/cache/index.go:248 (make+copy).

Impact

Latent/dormant today — the builder is reached only under IsEPPEmissionEnabled(), off by default (Coraza injected via the extension server's PostTranslateModify, not EnvoyPatchPolicies). Fixes the corruption pre-emptively so enabling EPP emission doesn't ship a cross-policy config bug: SecRuleEngine On/DetectionOnly/Off, score thresholds, and rule removals could bleed across policies (order- and capacity-dependent).

Tests

TestGetCorazaDirectivesDoesNotAliasRouteBaseDirectives — seeds the shared base slice with spare capacity, builds an Enforce policy, then builds a second Observe policy and asserts the first's SecRuleEngine On was not overwritten to DetectionOnly.

Confirmed to fail on the aliased code (the leak reproduces exactly) and pass with slices.Clone:

--- FAIL: TestGetCorazaDirectivesDoesNotAliasRouteBaseDirectives
    ... does not contain "SecRuleEngine On"
    second policy leaked into the first via a shared RouteBaseDirectives backing array

Verification

• go build ./internal/controller/... — clean
• go vet ./internal/controller/... — clean
• go test ./internal/controller/ -run TestGetCorazaDirectives — ok

Fixes #246. Related: #242.