reverse_tunnel: observe peer GOAWAY in drain-aware HCM and re-dial the tunnel

[ivpr]

Commit Message: When a reverse-tunnel accepted by the drain-aware HCM filter receives a peer-initiated HTTP/2 GOAWAY, drop the tunnel from the ReverseConnectionIOHandle's tracking and kick the maintenance loop so a replacement tunnel is dialed before the original TCP socket closes. Gated behind the same opt-in runtime guard as the upstream-side GOAWAY emission (envoy.reloadable_features.reverse_tunnel_drain_with_goaway).

Additional Description: HCM::onGoAway is a no-op by default. For reverse tunnels that means a peer GOAWAY from the upstream side is observed at the H2 server codec on the downstream side and then discarded; the tunnel sits in the initiator's tracking map as if nothing happened until the TCP socket eventually closes.

This change introduces three pieces, all behind the same runtime guard introduced by the upstream-side admin endpoint:

• DrainAwareConnectionCallbacksWrapper (new header drain_aware_hcm/drain_aware_connection_callbacks_wrapper.h) decorates Http::ServerConnectionCallbacks. It forwards every callback unchanged and additionally fires a user-supplied hook on onGoAway. HCM's onGoAway forward stays a no-op, so behavior toward HCM is unchanged; the hook is what lets the reverse-tunnel layer react. Mirrors the ConnectionCallbacksWrapper pattern used elsewhere in source.

• In drain_aware_hcm::DrainAwareHttpConnectionManagerConfig::createCodec, when the runtime guard is enabled, recover the ReverseConnectionIOHandle that owns this tunnel by typed cast on the accepted socket's IoHandle (DownstreamReverseConnectionIOHandle carries its parent + connection_key as members) and wrap the HCM callbacks with DrainAwareConnectionCallbacksWrapper. The hook calls owner->markTunnelDrainingAndDialReplacement(connection_key).

  Note: we cannot key off connection.localAddress() because the reverse_conn_listener exposes its bound rc:// address rather than the outbound TCP socket's local port that the IOHandle tracks. The typed cast avoids that alignment problem.

  DrainAwareServerConnection now owns the wrapping callbacks so its lifetime matches the codec's (the codec stores a bare reference).

• ReverseConnectionIOHandle::markTunnelDrainingAndDialReplacement (new public method) erases the connection_key from host_to_conn_info_map_[host].connection_keys, drops the gauge state, and kicks rev_conn_retry_timer_->enableTimer(0ms) so maintenance runs on the next dispatcher pass and dials a replacement. The underlying TCP socket is left alone so in-flight H2 streams complete naturally; onDownstreamConnectionClosed is made idempotent so the eventual TCP close is a benign debug-log no-op when tracking is already gone.

• DownstreamReverseConnectionIOHandle gains two public accessors: connectionKey() and parent(). The cast above relies on these.

When the runtime guard is disabled (the default), createCodec skips the wrapping callbacks creation; the codec uses the unwrapped HCM callbacks, peer GOAWAY remains a no-op in HCM::onGoAway, and markTunnelDrainingAndDialReplacement has no callers. Existing behavior is preserved bit-for-bit.

Risk Level: Low. All new behavior is gated by an opt-in runtime guard, default off, that must be flipped on each downstream Envoy process. markTunnelDrainingAndDialReplacement has no other callers, and onDownstreamConnectionClosed's idempotency change is a strict log-level downgrade ("warn" -> "debug") for an already-benign no-op that can also now arise from manual races against the (still-not-called) mark-draining method.

Testing: Unit tests added:

• drain_aware_connection_callbacks_wrapper_test.cc (5 tests) exercising the wrapper's forwarding and the GOAWAY hook.
• 4 new tests in reverse_connection_io_handle_test.cc for markTunnelDrainingAndDialReplacement: happy path, unknown key, idempotent-with-close, idempotent on second call.

Manual end-to-end validation:

• 2-Envoy upstream/downstream pair: with the runtime guard enabled, POST /reverse_tunnel/drain_cluster on the upstream causes all three components (upstream admin handler, peer-GOAWAY wrapper on DS, IOHandle mark-draining) to fire in the expected order, and the downstream re-dials.
• 3-Envoy DNS failover: a slow in-flight request on R1 completes with HTTP 200 despite a drain triggered mid-stream; a DNS change to R2 + the maintenance loop establishes a fresh tunnel to R2; requests to R1 fail only after its drain-time elapses; requests to R2 keep working.
• Same scenarios run with the guard disabled confirm no observable change vs. main.

Docs Changes: n/a.

Release Notes: When the envoy.reloadable_features.reverse_tunnel_drain_with_goaway runtime guard is enabled, the reverse-tunnel drain-aware HCM filter now observes peer-initiated GOAWAY on reverse-tunnel sockets and asks the initiator to drop the tunnel from tracking and dial a replacement. In-flight streams on the original tunnel complete naturally.

[basundhara-c]

I think this should be declared above inner so that while destroying the codec is destroyed first and the wrapper outlives the codec

[basundhara-c]

This duplicates a lot of the cleanup logic onDownstreamConnectionClosed already does, let's move this to a helper and call it from both the functions:

• dropTunnelFromTracking(key): add a helper which finds the host, erases key etc
• call it from onDownstreamConnectionClosed and markTunnelDrainingAndDialReplacement
• looks like onDownstreamConnectionClosed waits for the next maintainence timer (10s) and markTunnelDrainingAndDialReplacement keeps it for the next dispatcher tick, maybe we can use the same re-initiation interval for both cases (set both to the next dispatcher tick)

[basundhara-c]

You can use MAKE_ADMIN_HANDLER(x) here

[basundhara-c]

We can add a constant for "envoy.clusters.reverse_connection" and use it here and in reverse_connection.cc