Perform hostname checking on :authority before issuing call

We allow users to override the authority per-call, but we currently don't do any verification that that authority would be permitted for the current server. We should verify the provided authority against the TLS cert of the connection and fail in some way if the cert is not good for the requested authority. We would cache these verifications for the connection in a simple hash map.

It is the Java equivalent of https://github.com/grpc/grpc/pull/471

Start by locating the per-call :authority handling and the TLS certificate verification path. Compare the intended behavior with the referenced grpc/grpc pull request 471, then determine how failed authority checks and per-connection verification caching should be represented; done means unauthorized authorities cannot issue calls and repeated checks use the connection cache.

Written by the indexing model from the issue text.