config: add circuit breaker thresholds (#5650)

## Summary
Add a new `circuit_breaker_thresholds` option:

```yaml
circuit_breaker_thresholds:
  max_connections: 1
  max_pending_requests: 2
  max_requests: 3
  max_retries: 4
  max_connection_pools: 5
```

This option can be set at the global level or at the route level. Each
threshold is optional and when not set a default will be used. For
internal clusters we will disable the circuit breaker. For normal routes
we will use the envoy defaults.

## Related issues
-
[ENG-2310](https://linear.app/pomerium/issue/ENG-2310/add-circuit-breaker-settings-per-route)

## Checklist
- [x] reference any related issues
- [x] updated unit tests
- [x] add appropriate label (`enhancement`, `bug`, `breaking`,
`dependencies`, `ci`)
- [x] ready for review

config/options_test.go

@@ -32,6 +32,7 @@ import (
 	"github.com/spf13/viper"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"github.com/volatiletech/null/v9"
 	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/reflect/protoreflect"
 	"google.golang.org/protobuf/types/known/fieldmaskpb"
@@ -1035,6 +1036,21 @@ func TestOptions_ApplySettings(t *testing.T) {
 		assert.Equal(t, ptr([]string{"x", "y", "z"}), options.IDPAccessTokenAllowedAudiences,
 			"should preserve idp access token allowed audiences")
 	})
+
+	t.Run("circuit_breaker_thresholds", func(t *testing.T) {
+		t.Parallel()
+		options := NewDefaultOptions()
+		assert.Nil(t, options.CircuitBreakerThresholds)
+		options.ApplySettings(ctx, nil, &configpb.Settings{
+			CircuitBreakerThresholds: &configpb.CircuitBreakerThresholds{
+				MaxConnections: proto.Uint32(3),
+			},
+		})
+		assert.Equal(t, &CircuitBreakerThresholds{MaxConnections: null.Uint32From(3)}, options.CircuitBreakerThresholds)
+		options.ApplySettings(ctx, nil, &configpb.Settings{})
+		assert.Equal(t, &CircuitBreakerThresholds{MaxConnections: null.Uint32From(3)}, options.CircuitBreakerThresholds,
+			"should not erase existing circuit breaker thresholds")
+	})
 }
 
 func TestOptions_GetSetResponseHeaders(t *testing.T) {