TCP traffic tapping doesn't support any matching other than "any"

I've been experimenting with TCP traffic tapping of an upstream cluster. E.g.,:
```yaml
"transport_socket": {
"name": "envoy.transport_sockets.tap",
"typed_config": {
"@type": "type.googleapis.com/envoy.extensions.transport_sockets.tap.v3.Tap",
"common_config": {
"admin_config": {
"config_id": "mtu.hserver-multi-tenant-upstream.cerberus"
}
},
"transport_socket": {
"name": "envoy.transport_sockets.tls"
}
}
},
```
This example uses the `admin_config`, but that's not important. My question concerns the `static_config` alternative as well. Continuing with the admin config example, however, if I post this document to the `/tap` endpoint, it captures traffic:
```yaml
config_id: mtu.hserver-multi-tenant-upstream.cerberus
tap_config:
match:
any_match: true
output_config:
streaming: true
sinks:
- streaming_admin: {}
```
But if I post this document, with different match criteria, it never captures traffic, even when the header exists:
```yaml
config_id: mtu.hserver-multi-tenant-upstream.cerberus
tap_config:
match:
http_request_headers_match:
headers:
- name: x-capture
present_match: true
output_config:
streaming: true
sinks:
- streaming_admin: {}
```
Possibly this is intentional. After all, I'm tapping at the TCP level, not the HTTP level. But the [documentation](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/tap/v3/common.proto#config-tap-v3-tapconfig) doesn't say anything about matching (except for "any") not working when tapping at the TCP level. So I don't know if this is a bug or a documentation deficiency.

I tested with Envoy version

40de14954b29b4c1c87793482b90b27da3370f0f/1.17.0-dev/Clean/RELEASE/BoringSSL