Change the Merge behavior to Replace for BackendTrafficPolicy and SecurityPolicy.

Replace by the most specific resource is the default https://gateway.envoyproxy.io/v0.6.0/design/security-policy/#design-decisions , and support for Merge will hopefully be tackled in the near future with #1934