envoyconfig: add virtual host domains for certificates in addition to routes

[calebdoxsey]

Summary

Currently we only add domains to the envoy config based on routes. This means if we have a route from.example.com and a wildcard certificate *.example.com, that certificate will only be served to requests from from.example.com. So unknown.example.com would end up receiving a self-signed certificate. This PR updates the code to also add the *.example.com as a handled domain. This domain will have no routes attached to it, but it will serve the proper certificate, so the user would no longer receive a self-signed certificate.

Unlike route matching envoy matches filter chains based on most specific to least specific. So if there is a filter chain for *.example.com and another one for from.example.com, if a request comes in for from.example.com it will be sent to that filter chain regardless of the ordering of the filter chains. (so it's ok if *.example.com occurs first in the list)

Related issues

Fixes #3577

Checklist

• reference any related issues
• updated docs
• updated unit tests
• updated UPGRADING.md
• add appropriate tag (improvement / bug / etc)
• ready for review

[coveralls]

Coverage decreased (-0.06%) to 66.403% when pulling 5772f13 on cdoxsey/3577-unknown-routes into 8713108 on main.

[desimone]

Few suggestions, mostly around unit tests but otherwise LGTM!