Add private resource destinations to egress rules

[vitramir]

• `EgressRuleMatcher.private_resource_id`, mutually exclusive with `domain_pattern`; `ports` stays public-only
• `EgressRuleUpstreamTls` (`server_name`, `ca_bundle_secret_id` xor `insecure_skip_verify`) on `EgressRule` and the create/update requests
• `ListEgressRules` filters: `private_resource_id`, `target_kind`
• `ListEgressRulesByAgent`/`ByEnvironment` responses carry a `PrivateResourceInfo` map (`intercept_host`, `protocol`) keyed by resource id
• EgressRules internal RPCs: `CountRulesReferencingPrivateResource`, `ListMediatedPrivateResources`, `ListAttachedRuleDomains`
• `PrivateResource.mediation` (`PrivateResourceMediation` enum)
• Networks internal RPCs: `SetPrivateResourceMediation`, `ListPrivateResourcesReachableBy` (with per-resource `grants`); absent from `NetworksGateway`
• `UpdateServiceRequest.role_attributes_update` on Ziti Management

[github-actions]

The latest Buf updates on your PR. Results from workflow buf-pr / buf (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	✅ passed	✅ passed	✅ passed	Aug 14, 2026, 5:22 PM