dns_filter: feature req - DNS over TLS

Today, the upstream resolver is specified using IP/Port like this:

```yaml
dns_filter:
client_config:
resolver_timeout: 5s
upstream_resolvers:
addressList:
- address: 8.8.8.8, port: 53 #only plaintext dns
max_pending_lookups: 256
```

If we allow the specification of upstream resolvers using a cluster name reference, we will get DNS over TLS for free in addition to bunch of other [weird] functionalities. For example,

```yaml
dns_filter:
client_config:
resolver_timeout: 5s
upstream_resolver_cluster: my_dns_cluster
max_pending_lookups: 256
...
Clusters:
- name: my_dns_cluster
type: STATIC
lbEndpoints:
- 8.8.8.8, port 853
upstreamTLSContext:
....
```

If the request is not satisfied within the `resolver_timeout` period, then the resolution fails [just like http route timeout]. The question is should there be an API-ish mechanism to constrain the cluster type to just static or should we let the user use any normal cluster (strict_dns, eds, etc.). It doesn't really matter to the `client_config` as its just consuming the response from the cluster object.