Add support for Envoy's MySQL and Postgres filter types

This issue was originally created to address adding support for Terminating Gateways to work with AWS RDS databases (which don't work currently due to STARTTLS not being supported). It turns out this is actually a bit more complicated. Below is @blake's description of the issue and what needs to be done to get things working now.

---

There is no single standard for implementing [opportunistic TLS](https://en.wikipedia.org/wiki/Opportunistic_TLS) across application protocols. Because of this, applications like MySQL and PostgreSQL have implemented their own protocol-specific way to advertise support for TLS, and opportunistically upgrade transport sockets if TLS is supported by both the client and server.

As noted in Envoy's docs, the StartTls filter must be used with a network filter which understands the application protocol exchange. It cannot be directly enabled in a filter chain for a cluster.

> In the case of downstream StartTls, a network filter is **required** which understands protocol exchange and a state machine to signal to the StartTls transport socket when a switch to TLS is required. Similarly, upstream StartTls requires the owner of an upstream transport socket to manage the state machine necessary to properly coordinate negotiation with the upstream and signal to the transport socket when a switch to secure transport is required.

If Consul were to add support for using opportunistic TLS when connecting to MySQL or PostgreSQL, the following dependencies must be satisfied:

1. Envoy's MySQL and PostgreSQL filters need to be updated to support using STARTTLS for connections to upstream clusters. Support for this was added to the [StartTls](https://www.envoyproxy.io/docs/envoy/v1.19.0/api-v3/extensions/transport_sockets/starttls/v3/starttls.proto.html) filter in Envoy 1.19.x, however it does not appear that the MySQL and Postgres filters have been updated to use this new functionality.
1. Consul must upgrade from envoyproxy/go-control-plane from v0.9.5 to v0.9.9, the latter of which includes support for configuring the Postgres and StartTls filter types. This is currently blocked by #10471.
1. Lastly, Consul would need to add support for the experimental MySQL and Postgres filter types, and allow configuring the service's [protocol](https://www.consul.io/docs/connect/config-entries/service-defaults#protocol) type as `mysql` or `postgresql`.

Start by reviewing Envoy's MySQL and PostgreSQL filters and the upgrade from envoyproxy/go-control-plane v0.9.5 to v0.9.9, noting that this is blocked by issue #10471. Done means Consul supports the experimental MySQL and PostgreSQL filter types and accepts mysql or postgresql as service protocol values, with upstream STARTTLS support available.

Written by the indexing model from the issue text.