reduce health check rate if there is active succeeding traffic

This came up from a conversation I think with @snowp at KubeCon/EnvoyCon: we should be able to optionally lower the active health check rate if we are receiving a sufficient amount of passive traffic. As long as the upstream is able to send `x-envoy-immediate-health-check-fail` (as an upstream Envoy would do), draining should still be possible even in the passive case.

This would potentially mitigate some HC traffic explosion without having to resort to centralized HC.