xds: Support UpstreamTlsContext.sni with XdsChannelCredentials

gRFC A29 added XdsChannelCredentials, but the gRFC explicitly ignored the `sni` field. @dvilaverde in #11750 needs `sni`, so this issue was split out to track it. We'll need a small gRFC.

The current implementation is sending `sni` based on the original target instead of not sending any SNI. That's not good as it could cause a user to unknowingly depend on the incorrect behavior. So we do need to _at least disable_ SNI in the short-term. But it seems the work to disable SNI is most of the work to support `sni`. (Even when we support `sni` we need to support disabling SNI; if the field is empty that implies SNI is disabled.)