LDS/Enhancement: proactively close or gracefully drain idle downstream connections when an LDS-updated listener enters drain mode

[coolg92003]

Title: proactively close or gracefully drain idle downstream connections for LDS connection

Description:
This is an enhancement request for listener drain behavior during LDS updates.
When an LDS update modifies a listener, the old listener enters drain mode. Existing downstream connections remain attached to the old listener and old filter chain.
In our case, a downstream client establishes a TCP connection first, but does not send any HTTP/2 request yet. Then an LDS update changes the listener configuration and the old listener enters drain mode. Before drain_timeout expires, the client sends its first HTTP/2 request on that existing downstream connection.
That request is handled by the old listener / old HCM / old filter chain, so the newly delivered LDS config is not applied on that connection.

Enhancement request:
It would be useful if, once a listener enters drain mode due to LDS update, Envoy could proactively handle existing idle downstream connections so that the new listener configuration takes effect more predictably.

Requested behavior:

If the downstream connection is idle and no HTTP/2 session has been established yet, close the connection so the client reconnects and uses the updated listener config.
If the downstream connection is idle and an HTTP/2 session had already been established previously, start graceful drain, for example by sending GOAWAY.

Repro steps

• Start Envoy with the initial listener config.
• Have a client open a downstream TCP connection to Envoy on LDS port.
• Do not send any HTTP/2 request yet.
• Push an LDS update that changes the listener config(such as add new filter), so the old listener enters drain mode.
• Before drain_timeout: 20s expires, send the first HTTP/2 request on the existing downstream connection.
• Observe which cluster / route / filter chain handles the request.

Current behavior

• The old listener enters drain mode.
• The existing downstream TCP connection remains open.
• The first later HTTP/2 request sent on that connection is handled by the old listener configuration.
• The newly delivered LDS config is only applied to newly established downstream connections.

Proposed behavior
For an existing downstream connection on a listener that has entered drain mode due to LDS update:

1. If the connection is idle and has not established any HTTP/2 session yet, proactively close it so the client reconnects and picks up the new listener config.
2. If the connection is idle and an HTTP/2 session had already been established before, proactively start graceful HTTP/2 drain, for example with GOAWAY.
   Motivation
   This would reduce the window where old listener configuration continues handling later requests on already-open idle downstream connections, and would make listener cutover behavior more predictable for clients that pre-open connections.
   [optional Relevant Links:]

Any extra documentation required to understand the issue.

[wbpcode]

Sounds like a reasonable requirement if we can get a clean implementation and configuration flag