Differentiate "allow-all" and "allow-none" in ssl_context:verify_subject_alt_name

[myidpt]

"allow-all": No secure naming is checked.
"all-none": Secure naming is checked against an empty list of service accounts. So it always fails.

We need to verify whether Envoy supports the two cases through config. Ideally, an undefined verify_subject_alt_name field should mean "allow-all" and a defined but empty verify_subject_alt_name field should mean "allow-none".

[lookuptable]

This should be addressed by envoyproxy/envoy#615

[lookuptable]

envoyproxy/envoy#648 fixes this issue in Envoy upstream

[PiotrSikora]

Please note that envoyproxy/envoy#648 was reverted in Envoy (see: envoyproxy/envoy#615, envoyproxy/envoy#668).

[wattli]

@lookuptable , is this issue solved? I think currently we enforce client cert now.