Which next hop should be selected when configuring a static route to an on-premises resource behind a Cloud VPN gateway with policy-based routing using the gcloud command?