reverse_tunnel: add drain-aware HCM for hot restart with reverse tunnels

[basundhara-c]

Commit Message: add optional drain-aware HCM for hot restart with reverse tunnels

Additional Description:
Problem:

During hot restart of the initiator envoy, the HCM drain path only sends
HTTP/2 GOAWAY frames reactively — when a request arrives on a draining
connection. On idle reverse-tunnel connections (no in-flight requests),
GOAWAY is never sent because nothing triggers the drain sequence).

This means the responder envoy has no signal that the initiator is
draining. Services behind the responder may continue dispatching requests
over stale parent connections to the draining initiator. If a request
arrives just before parent shutdown, it fails and may not be safely
retryable (e.g., it already reached the upstream service). With multiple
parent connections on the same responder, each one requires a separate
request to trigger draining individually.

Solution:
Extend the HCM by introducing an optional extension called
drain_aware_http_connection_manager under the reverse_tunnel namespace.
This wraps the standard HCM and overrides the drain logic: when the
listener begins draining, a DrainAwareServerConnection wrapper detects
drain via polling DrainDecision::drainClose() and proactively sends an
HTTP/2 GOAWAY frame on active connections. This approach avoids any
changes to core HCM/drain code — all logic lives in the reverse tunnel
extension.

Risk Level: Low
Testing: Tests added
Docs Changes: N.A
Release Notes: N.A
Platform Specific Features:

[repokitteh-read-only]

As a reminder, PRs marked as draft will not be automatically assigned reviewers,
or be handled by maintainer-oncall triage.

Please mark your PR as ready when you want it to be reviewed!

🐱

Caused by: #43970 was opened by basundhara-c.

see: more, trace.

[basundhara-c]

/coverage

[repokitteh-read-only]

Coverage for this Pull Request will be rendered here:

https://storage.googleapis.com/envoy-cncf-pr/43970/coverage/index.html

For comparison, current coverage on main branch is here:

https://storage.googleapis.com/envoy-cncf-postsubmit/main/coverage/index.html

The coverage results are (re-)rendered each time the CI Envoy/Checks (coverage) job completes.

🐱

Caused by: a #43970 (comment) was created by @basundhara-c.

see: more, trace.