Provide built-in tooling to assist in debugging Envoy-related functionality

When debugging Consul + Envoy one of the first steps to take is to go through Envoy's configuration and see if it matches our expectations.

There are a couple key issues with that workflow:
1. Envoy's config dump has a lot of information that isn't needed for broad strokes debugging. It also takes some time to get comfortable navigating it.
2. You need to know what the config should look like.

These two issues likely need distinct solutions.

For the first we could add some CLI helpers that synthesize and output key configuration from Envoy:
* Listeners
* Names of static and dynamic listeners and the port they are listening on
* High-level information about filter chains attached to listeners, in the case of listeners that route to multiple upstreams using filter chains.
* Clusters/Endpoints
* Names of static and dynamic clusters
* Addresses associated with clusters
* Health of those endpoints
* Certificates
* Are any expired?

Regarding the second issue: the xds package is currently the only place that encodes how we expect Envoy to be configured given different proxy definitions. It would be helpful if these were documented somewhere.

For example: For transparent proxies we expect a filter chain per upstream, with a match rule for the virtual IP of the upstream.

These are only two options, there's definitely a lot more that could be done. Like some sort of diagnostics CLI, etc.

Start by reading the xds package to understand how Consul encodes expected Envoy configurations for proxy definitions, then review the proposed listener, cluster, endpoint, and certificate diagnostics. The issue does not identify files, commands, tests, or a settled scope; work is complete only after a specific diagnostic or documentation scope is agreed and its expected output is tested or documented.

Written by the indexing model from the issue text.