Config validation without secret validation

Currently when running Envoy with `--mode validate` it will attempt to load and validate the contents of the secrets referenced by the config. While this might be useful when the config is validated in the context in which Envoy will ultimately run, it makes setting up config validation as part of a CI pipeline tricky due to having to generate various test secrets.

A mode that validates that the config is correct (i.e. passes pgv validation) without relying on the state of the file system would simply this process and make it possible to do lightweight config validations.

I imagine this would require stubbing out a lot of the TLS classes that are used during validation for ones that won't actually try to read any of the file content.