add support for nginx-ingress' feature: ssl-reject-handshake

I'm trying to replicate the behavior of Nginx's ssl-reject-handshake option [1]. What this does is abort the SSL connection, without sending the cert, if a connection comes in with a non-matching hostname. The purpose being to help prevent fingerprinting of other valid endpoints.

I can replicate this to some extent if I explicitly set a hostname for every Listener, ie
```listeners:
- name: https-foo
hostname: foo.example.com
port: 443
protocol: HTTPS
tls: {...}
- name: https-bar
hostname: bar.example.com
port: 443
protocol: HTTPS
tls: {...}
```
then connections to non-matching hostnames (`baz.example.com`) will abort before sending the certificate.

But, if I use a single wildcard Listener instead (`*.example.com`), and attach the two `foo` and `bar` routes to it, then a connection to `baz` will return a 404 using the configured cert.
I assume this is because the connection is accepted/rejected based solely on the Listener config, and doesn't consider any attached routes.

But I have a security requirement to keep this behavior, so an option to explicitly enable this (even with wildcard listeners) would be helpful.

[1] https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#ssl-reject-handshake