rbac: support match based on destination cluster

*Description*:
Envoy can route traffic to clusters based on external given input, e.g. `cluster_header` in http_conn_manager, and there will be similar proposal for TCP in #4444. We should disallow traffic from listeners going to certain clusters, e.g. xDS API cluster (especially SDS), ratelimit cluster, ext_authz cluster etc.

cc @rshriram

*Relevant Links*:
https://github.com/envoyproxy/envoy/pull/4444#discussion_r218427696