connect: allow configuration of "outlier detection"

[banks]

Scope:

• No RFC needed
• Some minor UX work to decide best config to support that will be maximally future compatible with other proxy integrations. The rationale can be given in PR description and signed off as part of review.
• O(days) task to add the config, plumb though to Envoy and write tests (assuming familiarity)

---

Allow configuration of Envoy's client side outlier detection.

Envoy names this feature "outlier detection" while uses the term "circuit breaker" to refer to connection pool limits. Many other systems tend to use "circuit breaker" to describe this pattern of avoiding sending traffic to nodes which have recently failed. See https://martinfowler.com/bliki/CircuitBreaker.html

We should carefully consider how we expose the config here as we want to be proxy-agnostic and other proxies use different terminology. We might avoid the term "circuit breaker" just because that means something else in Envoy land.

It would be good to review how similar controls are implemented in other major proxies (HAProxy, Nginx at least) to make sure we come up with something that is meaningful for all ideally or can discuss the best tradeoff otherwise.

One term I think works reasonably well here is "Passive health checking".

It would be ideal to be able to specify global defaults in the global proxy-defaults ConfigEntry that would be inherited by services that don't explicitly set their own. Otherwise this is expected to live in service-defaults (or wherever we decide upstream defaults go as part of #6359).

[dnephin]

Config reference: envoy, nginx, haproxy