Auth: add explicit SNI name support for ExtensionService

[jpeach]

Please describe the problem you have

The ExtensionService processing configures Envoy to send a SNI server name when upstream TLS validation is enabled. However, there may be cases where you need to send a different name than you validate or you want to send the name but not validate.

Two options seem appropriate:

1. Allow upstream validation with just a server name (CA secret omitted). This is the same API as now, but easier to use.
2. Add a new field to set the SNI name. This adds API complexity and flexibility.

[github-actions]

The Contour project currently lacks enough contributors to adequately respond to all Issues.

This bot triages Issues according to the following rules:

• After 60d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, the Issue is closed

You can:

• Mark this Issue as fresh by commenting
• Close this Issue
• Offer to help out with triage

Please send feedback to the #contour channel in the Kubernetes Slack

[github-actions]

The Contour project currently lacks enough contributors to adequately respond to all Issues.

This bot triages Issues according to the following rules:

• After 60d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, the Issue is closed

You can:

• Mark this Issue as fresh by commenting
• Close this Issue
• Offer to help out with triage

Please send feedback to the #contour channel in the Kubernetes Slack