dns cache: add dns_min_refresh_rate configuration (#20418)

Signed-off-by: Matt Klein <mklein@lyft.com>

Mirrored from https://github.com/envoyproxy/envoy @ 69105c91ec8e47a8f5716504d5101a9d1e318e33

envoy/extensions/common/dynamic_forward_proxy/v3/dns_cache.proto

@@ -33,7 +33,7 @@ message DnsCacheCircuitBreakers {
 
 // Configuration for the dynamic forward proxy DNS cache. See the :ref:`architecture overview
 // <arch_overview_http_dynamic_forward_proxy>` for more information.
-// [#next-free-field: 14]
+// [#next-free-field: 15]
 message DnsCacheConfig {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.config.common.dynamic_forward_proxy.v2alpha.DnsCacheConfig";
@@ -61,10 +61,16 @@ message DnsCacheConfig {
   // The refresh rate is rounded to the closest millisecond, and must be at least 1ms.
   //
   // Once a host has been resolved, the refresh rate will be the DNS TTL, capped
-  // at a minimum of 5s.
+  // at a minimum of `dns_min_refresh_rate`.
   google.protobuf.Duration dns_refresh_rate = 3
       [(validate.rules).duration = {gte {nanos: 1000000}}];
 
+  // The minimum rate that DNS resolution will occur. Per `dns_refresh_rate`, once a host is
+  // resolved, the DNS TTL will be used, with a minimum set by `dns_min_refresh_rate`.
+  // `dns_min_refresh_rate` defaults to 5s and must also be >= 5s.
+  google.protobuf.Duration dns_min_refresh_rate = 14
+      [(validate.rules).duration = {gte {seconds: 5}}];
+
   // The TTL for hosts that are unused. Hosts that have not been used in the configured time
   // interval will be purged. If not specified defaults to 5m.
   //