websocket: tunneling websockets (and upgrades in general) over H2 (#4188)

This allows tunneling over H2, unfortunately only enabled via nghttp2_option_set_no_http_messaging until nghttp2/nghttp2#1181 is sorted out. See the big warnings about not using (at least without knowing you're going to have a roll-out that may break backwards-compatibility some time in the not too distant future)

Risk Level: Medium (changes are contained behind H2-with-Upgrade header which doesn't work today)
Testing: unit tests, and turned up the full H1/H2 upstream/downstream in the integration test
Docs Changes: for now, though I may take them out. I think they're useful for review.
Release Notes: not added since we don't want folks using it (outside of testbeds) yet.
#1630

Signed-off-by: Alyssa Wilk <alyssar@chromium.org>

Mirrored from https://github.com/envoyproxy/envoy @ cd171d9a95f551628453c83f0b00924e8b310bf0

envoy/api/v2/core/protocol.proto

@@ -76,6 +76,20 @@ message Http2ProtocolOptions {
   // window. Currently, this has the same minimum/maximum/default as *initial_stream_window_size*.
   google.protobuf.UInt32Value initial_connection_window_size = 4
       [(validate.rules).uint32 = {gte: 65535, lte: 2147483647}];
+
+  // [#not-implemented-hide:] Hiding until nghttp2 has native support.
+  //
+  // Allows proxying Websocket and other upgrades over H2 connect.
+  //
+  // THIS IS NOT SAFE TO USE IN PRODUCTION
+  //
+  // This currently works via disabling all HTTP sanity checks for H2 traffic
+  // which is a much larger hammer than we'd like to use. Eventually when
+  // https://github.com/nghttp2/nghttp2/issues/1181 is resolved, this will work
+  // with simply enabling CONNECT for H2. This may require some tweaks to the
+  // headers making pre-CONNECT-support proxying not backwards compatible with
+  // post-CONNECT-support proxying.
+  bool allow_connect = 5;
 }
 
 // [#not-implemented-hide:]