tls: add upstream certificate selector

[kyessenov]

Change-Id: Id41a4b09a7468def0e21f775c3302195399eb997

Commit Message: Extends the dynamic selector support to the upstream TLS context as well. Additional Description: Split out of https://github.com/envoyproxy/envoy/pull/42072 to make it easy to review. The goal is to enable filter-state based programming of upstream TLS contexts. Risk Level: low, mostly aligned with downstream selector Testing: added Docs Changes: yes Release Notes: none (no net new feature yet)

[repokitteh-read-only[bot]]

CC @envoyproxy/api-shepherds: Your approval is needed for changes made to (api/envoy/|docs/root/api-docs/). envoyproxy/api-shepherds assignee is @wbpcode CC @envoyproxy/api-watchers: FYI only for changes made to (api/envoy/|docs/root/api-docs/).

:cat:

Caused by: https://github.com/envoyproxy/envoy/pull/42477 was opened by kyessenov.

see: more, trace.

[kyessenov]

CC @ggreenway since it's related to the other PR. I'll combine the work together once they start merging.

[wbpcode]

I am not familiar to TLS code base. Let's expert to handle this. :)