vpn: change connections based on reachability

Although Envoy Mobile works with VPNs, there is room for improvement as outlined in the investigation written up in https://github.com/lyft/envoy-mobile/pull/728.

By observing reachability, we're able to identify when a VPN is enabled or disabled on a client device. Using this information, we should be able to more aggressively change connections to force Envoy Mobile to utilize a connection on the preferred network.

This should result in Envoy Mobile switching onto a VPN when it becomes enabled, and switching to an active non-VPN connection when a VPN becomes disabled.