Add filter-cc: a tested, docs-first native filter build example using bzlmod

[Copilot]

Adds the agreed hard-blocker for the envoy bzlmod migration: a full, tested example showing how a downstream developer builds a native Envoy HTTP filter (statically linked) with bzlmod. Modelled on wasm-cc, ports the old envoy-filter-example sample header filter, and is docs-first — the tested artefacts (MODULE.bazel, BUILD, envoy.yaml, …) are exactly what is documented.

filter-cc/ module

• MODULE.bazel per the issue sketch — envoy/envoy_api deps, envoy_toolchains_extension (clang_platform), LLVM toolchain wiring as dev_dependency (same setup as wasm-cc); extension wiring validated against envoy main now that docs/bazel: Switch to bzlmod envoy#47155 has merged.
• BUILD — api_proto_package(), filter libs, statically linked //:envoy, and http_filter_integration_test (real integration test for bazel test //... / BCR presubmit).
• Filter sources ported from http-filter-example, updated for envoy head: uses the non-deprecated UnifiedFactoryBase API instead of overriding the deprecated NamedHttpFilterConfigFactory::createFilterFactoryFromProto, and leans on PassThroughDecoderFilter for the boilerplate:

class HttpSampleDecoderFilterConfigFactory
    : public Extensions::HttpFilters::Common::UnifiedFactoryBase<sample::Decoder> {
public:
  HttpSampleDecoderFilterConfigFactory() : UnifiedFactoryBase("sample") {}
  ...

• envoy.yaml using the sample filter, docker-compose.yaml (proxy from built binary + echo backend), docker-compose-build.yaml (filter_build/filter_test via shared/build, same pattern as wasm_compile_update), Dockerfiles, example.rst, README.md.
• .bazelrc is bzlmod-first (unlike wasm-cc's workspace default), with BCR + envoy bazel-registry and the downstream-relevant flags from envoy's .bazelrc.

Testing

• verify.sh — builds //:envoy in the shared build container, brings up the composition, asserts the filter's Via: sample-filter header appears on proxied requests.
• .github/workflows/_verify_filter.yml (wired into verify.yml) — pins envoy main head via git_override and builds //:http_filter_config in the build container. Per open decision 1 in the issue, CI proves the extension wiring cheaply; the full static link is left to verify.sh and BCR presubmit (hosted runners can't sustain a full envoy link).

Integration & publishing

• Root MODULE.bazel: bazel_dep + local_path_override for envoy-example-filter-cc — the same mechanism envoy head-testing uses for wasm-cc.
• Root BUILD: wired into :configs, :docs_rst, the examples_docs toctree genrule and the :docs tar.
• .bcr/filter-cc/{metadata.template.json,presubmit.yml,source.template.json} + moduleRoots entry so it is published alongside wasm-cc.

Follow-ups (per issue): envoy-side head testing of all build examples, and the dynmod example reusing this structure.

• Fixes Add a tested, docs-first native filter build example (filter-cc) using bzlmod #1389