fix(translator): pass BackendTLSPolicy TLS IR with empty CAPEMs instead of dropping

- Translator: no longer drops BackendTLSPolicies with invalid CA cert refs;
  passes TLS IR with empty CAPEMs to dataplane, which fails at handshake
  with HTTP 500 instead of control plane returning HTTP 400.
- Status: Accepted=True for structurally-valid policies with invalid
  CA refs (ResolvedRefs=False reflects the ref resolution failure).
- Fixes conformance: nonexistent-ca-certificate-ref, invalid-kind,
  san-dns tests now return 500/502/503 as expected.

Author: mahmut-Abi

internal/status/backend_tls_policy_ancestors.go

@@ -365,7 +365,7 @@ func invalidAcceptedPolicyCondition(generation int64, message string) conditionS
 func noValidCACertificateAcceptedCondition(generation int64) conditionSpec {
 	return acceptedPolicyCondition(
 		generation,
-		metav1.ConditionFalse,
+		metav1.ConditionTrue,
 		backendTLSPolicyReasonNoValidCACert,
 		"BackendTLSPolicy does not contain any valid CA certificate references",
 	)

internal/status/reconciler_backend_tls_validation_test.go

@@ -842,7 +842,7 @@ func TestReconcileRejectsBackendTLSPolicyWithInvalidCustomCAConfigMap(t *testing
 		t,
 		policy.Status.Ancestors[0].Conditions,
 		string(gatewayv1.PolicyConditionAccepted),
-		metav1.ConditionFalse,
+		metav1.ConditionTrue,
 		backendTLSPolicyReasonNoValidCACert,
 		1,
 	)

internal/translator/backends/tls_policy.go

@@ -113,10 +113,7 @@ func translateBackendTLSPolicyValidationWithIndexes(
 			return nil, false
 		}
 
-		caPEMs, ok := backendTLSPolicyCAPEMsWithIndexes(indexes, policy.Namespace, validation.CACertificateRefs)
-		if !ok || len(caPEMs) == 0 {
-			return nil, false
-		}
+		caPEMs, _ := backendTLSPolicyCAPEMsWithIndexes(indexes, policy.Namespace, validation.CACertificateRefs)
 
 		return &ir.BackendTLSValidation{
 			Hostname:        string(validation.Hostname),