Commit Message: ratelimit: option to excute action on stream done

Additional Description:
This adds a new option apply_on_stream_done to the Action
message of the http ratelimit. This basically allows to configure
actions to be executed in a response content-aware way and do not
enforce the rate limit (in other words "fire-and-forget"). Since addend
can be currently controlled via envoy.ratelimit.hits_addend metadata,
another filter can be used to set the value to reflect their intent there,
for example, by using Lua or Ext Proc filters.

This use case arises from the LLM API services which usually return
the usage statistics in the response body. More specifically,
they have "streaming" APIs whose response is a line-by-line event
stream where the very last line of the response line contains the
usage statistics. The lazy nature of this action is perfectly fine
as in these use cases, the rate limit happens like "you are forbidden
from the next time".

Besides the LLM specific, I've also encountered the use case from the
data center resource allocation case where the operators want to
"block the computation from the next time since you used this much
resources in this request".

Ref: envoyproxy/gateway#4756

Risk Level: low
Testing: TODO
Docs Changes: done (via comments in proto)
Release Notes: TODO
Platform Specific Features: n/a

---

the description might not reflect the actual change as it's being discussed and developed - please refer to the diff for now

Request variables

Key	Value
ref	f9e79c7
sha	011a816
pr	37548
base-sha	602a2b9
actor	@mathetake
message	http ratelimit: option to reduce budget on stream done ...
started	1733966086.098874
target-branch	main
trusted	false

Container image/s (as used in this CI run)

Envoy version (as used in this CI run)