Static/dynamic analysis of data plane exceptions on worker threads

In general, there should be no exceptions on worker threads, and they should only happen on the main thread. To validate this at runtime (and during test runs which should catch most instances), I propose we replace all:
```
try {
...
} catch (..) {..}
```
in Envoy with
```
envoy_try {
...
} catch (..) {..}
```
where `envoy_try` is something like:
```
#define envoy_try \
ASSERT(gettid() == main_thread_tid); \
try
```
This bug tracks this proposal and implementation work. There's probably a number of data plane exceptions which still happen on worker threads, which need to be fixed before the `ASSERT` can be merged, but we can convert to the new macro to facilitate this. We would also augment `check_format` to catch any raw `try` statements.

@envoyproxy/maintainers WDYT?
CC @chaoqin-li1123 @asraa