Proposed changes

Problem: createExternalReferencesForTLSSecretsResolver in internal/controller/state/graph/gateway_listener.go carried a //nolint:gocyclo directive and a FIXME(bjee19), called out in #5253 as gocyclo tech debt.

Solution: Decompose the listener resolver closure into three focused helpers — resolveTLSCertRef (single certificate ref resolution), certRefPermitted (ReferenceGrant permission predicate), and applyCertRefErrors (error aggregation into listener conditions). Behavior is preserved; the //nolint:gocyclo and FIXME(bjee19) are removed.

This is one slice of #5253 — the issue tracks ~14 such functions, so this PR uses related: rather than Closes to avoid auto-closing the umbrella issue.

Validation:

• golangci-lint run ./internal/controller/state/graph/ — 0 issues (gocyclo satisfied)
• go test ./internal/controller/state/graph/... — pass
• gofmt / go vet / go build — clean

related: #5253

NONE