Possible to close a connection programatically or as the result of a particular response header from a backend?

We're looking for a way to force connections to close after fully sending a particular reply, e.g. a 403 or 421, forcing downstream clients to re-connect - even if they have a misbehaving client. Note: I am NOT referring to draining the listener. The listener will remain active indefinitely.

Based on my understanding the h1.1 `Connection: Close` response header is no longer respected by h2 clients and I can't find a way to tell Envoy to send a GOAWAY programmatically.

Previous proxy software I've worked with had the option to send a response and then optionally discard the TCP connection - basically send a FIN just after writing out the response.

Is there some way to do this in Envoy which I am missing, e.g. in Lua?

Again, we're looking for some way to tell Envoy to FIN the downstream client connection after delivering a particular response (by response code or checking for a response header from our backend.