fix(meshpassthrough): don't remove all filters chains

[lukidzi]

Checklist prior to review

While debugging the tests, I noticed a log entry:

error adding listener 'outbound:passthrough:ipv6': no filter chains specified

This leads to the case where the MeshPassthrough policy might consist of only IPv4 or IPv6-specific entries. In such cases, the current logic removes all filter chains and initializes a new, empty filter chain. If there’s no match for the specific IP protocol, the list could end up empty, which may cause Envoy to reject the configuration. I've added a change to check if there are rules for a specific IP protocol, and only trigger the logic if rules exist.

• Link to relevant issue as well as docs and UI issues --
• This will not break child repos: it doesn't hardcode values (.e.g "kumahq" as a image registry) and it will work on Windows, system specific functions like syscall.Mkfifo have equivalent implementation on the other OS --
• Tests (Unit test, E2E tests, manual test on universal and k8s) --
  • Don't forget ci/ labels to run additional/fewer tests
• Do you need to update UPGRADE.md? --
• Does it need to be backported according to the backporting policy? (this GH action will add "backport" label based on these file globs, if you want to prevent it from adding the "backport" label use no-backport-autolabel label) --