Provide a way for envoy sidecars to filter upstreams based on tags

#### Feature Description

It would be very cool if it were possible to tell `consul connect envoy` to filter upstreams based on tags. This would be useful if one has a service named `backend` exposing `http` & `metrics` instances so envoy could access only the http instances.

#### Use Case(s)

I am currently trying to put nomad behind an envoy proxy for certain things and nomad registers instances with the tags `serf`, `rpc` and `http`. Now I'd like to relatively easily tell envoy to be a proxy for the `http` tag. I do know that I can configure subsets on the service resolver and then add an extra service that routes to that, but that is quite some overhead…

Start at the `consul connect envoy` command and compare the requested tag filter with the existing service-resolver subset approach described in the issue. Define the configuration and behavior for selecting only tagged upstream instances, then verify it with an Envoy sidecar exposing only the requested tag.

Written by the indexing model from the issue text.