fix: initial fetch timed out for type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret

[yuehaii]

Issue description
the initial_fetch_timeout: 0s will disable timeout in envoy. however, that setting only applies to LDS and CDS, not to SDS (Secret). It caused initial fetch timed out for type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret.

What this PR does / why we need it:
the sds_config can't be added in to dynamic_resources. the config.bootstrap.v3.Bootstrap.DynamicResources only has three fields listed below. the SDS go through xDS discovery.
{
"lds_config": {...},
"cds_config": {...},
"ads_config": {...}
}

This PR set xDS default InitialFetchTimeout as 0 to mitigate the issue.

Which issue(s) this PR fixes:
Fixes #9373

---

PR Checklist

• Authorship & ownership: Coding agents / AI assistants are welcome, but I have reviewed every change, understand how and why it works, can explain and maintain it, and take full responsibility for this PR. I have not submitted generated output I do not understand.
• DCO: All commits are signed off (git commit -s). See DCO: Sign your work.
• API agreed first: N/A: no API changes.
• Required checks pass: make generate gen-check, make lint, and the unit-test/coverage build pass. (Flaky e2e failures are not considered breakages, but gen-check, lint, and coverage MUST pass.)
• Tests added/updated: New/changed code is covered by appropriate tests. N/A if this PR does not contain code changes.
• Docs: N/A. this PR does not contain user-facing changes.
• Release notes: For any non-trivial change, added a release-note fragment under release-notes/current/<section>/<pr-number>-<slug>.md (see release-notes/current/README.md for sections and naming). N/A if this PR does not contain non-trivial changes.
• Generated files committed: N/A: no API / helm / module changes.
• Scope & compatibility: The PR is reasonably scoped (no unrelated changes) and preserves backward compatibility, or any breaking change is called out above and documented in release-notes/current/breaking_changes/.
• Codex review: Requested a Codex review and addressed all of its comments.
• Copilot review: Requested a Copilot review and addressed all of its comments.

[netlify]

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Name	Link
🔨 Latest commit	109d46c
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/6a5e1dd4c1ff2f000868feb5
😎 Deploy Preview	https://deploy-preview-9532--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 109d46c6c5

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Update the xDS golden outputs

This new field is present on every ConfigSource returned by makeConfigSource, so the serialized listeners/clusters will now include initialFetchTimeout: 0s. The translator tests compare the full serialized resources against internal/xds/translator/testdata/out (translator_test.go checks listeners and clusters directly), but those goldens still omit the field for existing ADS RDS/SDS config sources such as simple-tls.listeners.yaml, so go test ./internal/xds/translator will fail once the required Go toolchain is available. Please commit the regenerated translator/egctl golden outputs with this code change.

Useful? React with 👍 / 👎.