Passing auth result (client identity) to the backend / the next hop

[myidpt]

This requires Envoy to forward auth results to next hop. It is tracked by:
envoyproxy/envoy#794
After that, Istio should configure:

1. For Side-car proxies, they always forward auth result to the backend.
2. For cluster ingress controllers, when external service uses mTLS to call ingress controllers, the latter always forwards the auth result of to the next hop.