When building an upstream validation context for a particular URL, check
whether the hostname is an IP address. If so, configure the SAN match to
use type IP_ADDRESS rather than DNS.
* envoy: check certificates for must-staple flag and drop them if they are missing the response
* Update config/envoyconfig/tls_test.go
Co-authored-by: Denis Mishin <dmishin@pomerium.com>
Co-authored-by: Denis Mishin <dmishin@pomerium.com>
* wip
* wip
* handle wildcards in override name
* remove wait for ready, add comment about sync, force initial sync complete in test
* address comments
