Resource-based circuit breaking

**Description**

Envoy should have the ability to circuit break on system resources like CPU.

Circuit breakers at ingress are used to protect our hosts from resource exhaustion. To determine circuit breaker thresholds, we run a "redline" test, which increasingly ramps traffic on a single host until it degrades. We note `rq_active`, then set the threshold less some buffer.

Over time this ends up being a poor approximation for the real bottleneck for most of our services, CPU:
- If any of the service's dependencies slow down, a single host can handle additional concurrency without exhausting its local resources.
- If a service (the local service or a downstream) ships code that changes the overall load profile and/or the overall request mix, the circuit breaker may no longer protect the service or circuit break early.

Working out the platform-dependent implementation and the algorithm will be the fun part. I'd like to get a first impression from other users before getting into that.