Connect service resolver filter by tag (with dash) not working

#### Overview of the Issue

I am trying to replicate fabio's behavior with the ingress gateway but I am not able to filter by service tags if they contain dash.

#### Reproduction Steps

* Start a `consul agent -dev`

* Register and start a service with consul connect enabled and a tag `public-test.example.com/foo/bar`.

```
curl -X PUT localhost:8500/v1/catalog/register -d @srv.json
```
```
{
"Name": "service2",
"Tags": ["primary", "v1", "public-test.example.com/foo/bar"],
"Address": "127.0.0.1",
"Port": 8000,
"Check": {
"tcp": "localhost:8000",
"interval": "10s",
"timeout": "1s"
},
"connect": { "sidecar_service": {} }
}
```

I use a simple http server and envoy as a sidecar `consul connect envoy -sidecar-for service2`

* Start the ingress gateway :

```
consul connect envoy -gateway=ingress -register -service ingress-gateway -address '127.0.0.1:18880' -admin-bind 0.0.0.0:19000
```

* Create the consul configuration with `consul config write ...`

Proxy defaults :

```
{
"Kind": "proxy-defaults",
"Name": "global",
"Config": {
"protocol": "http"
}
}
```

Ingress gw :

```
{
"Kind": "ingress-gateway",
"Name": "ingress-gateway",
"TLS": {
"Enabled": false
},
"Listeners": [
{
"Port": 18080,
"Protocol": "http",
"Services": [
{
"Name": "ingress-gateway-service-router",
"Hosts": [
"*.example.com"
]
}
]
}
]
}
```

Servicer resolver configuration :

```
{
"ConnectTimeout": "5s",
"Kind": "service-resolver",
"Name": "service2",
"Subsets": {
"public-testexamplecomfoobar": {
"Filter": "public-test.example.com/foo/bar in Service.Tags"
}
}
}
```

Service router configuration :

```
{
"Kind": "service-router",
"Name": "ingress-gateway-service-router",
"Routes": [
{
"Match": {
"HTTP": {
"PathPrefix": "/",
"Header": [
{
"Name": "Host",
"Exact": "test.example.com"
}
]
}
},
"Destination": {
"Service": "service2",
"ServiceSubset": "public-testexamplecomfoobar"
}
}
]
}
```

It's not working and I got this log over and over on consul :

```
2021-03-29T10:18:52.554+0200 [WARN] agent.cache: handling error in Cache.Notify: cache-type=health-services error="Failed to create boolean expression evaluator: 1:7 (6): no match found, expected: "!=", ".", "==", "[", [ \t\r\n] or [a-zA-Z0-9_]" index=0
2021-03-29T10:18:52.554+0200 [ERROR] agent.proxycfg: Failed to handle update from watch: service_id=ingress-gateway id=upstream-target:public-testexamplecomfoobar.service2.default.dc1:ingress-gateway-service-router error="error filling agent cache: Failed to create boolean expression evaluator: 1:7 (6): no match found, expected: "!=", ".", "==", "[", [ \t\r\n] or [a-zA-Z0-9_]"
```

I tried to query the service health API manually with this command :
```
curl --get localhost:8500/v1/health/service/service2 --data-urlencode 'filter=public-test.example.com/foo/bar in Service.Tags'
```

Got the same log :
```
2021-03-29T09:51:18.767+0200 [ERROR] agent.http: Request error: method=GET url=/v1/health/service/service2?filter=public-test.example.com%2Ffoo%2Fbar%20in%20Service.Tags from=127.0.0.1:65114 error="Failed to create boolean expression evaluator: 1:7 (6): no match found, expected: "!=", ".", "==", "[", [ \t\r\n] or [a-zA-Z0-9_]"
2021-03-29T09:51:18.767+0200 [DEBUG] agent.http: Request finished: method=GET url=/v1/health/service/service2?filter=public-test.example.com%2Ffoo%2Fbar%20in%20Service.Tags from=127.0.0.1:65114 latency=335.62µs
```

So I add **double quotes** to the filter and **it is working** :

```
curl --get localhost:8500/v1/health/service/service2 --data-urlencode 'filter="public-test.example.com/foo/bar" in Service.Tags'

[{"Node":{"ID":"","Node":"foobar","Address":"192.168.10.2","Datacenter":"dc1","TaggedAddresses":null,"Meta":null,"CreateIndex":9,"ModifyIndex":9},"Service":{"ID":"service2","Service":"service2","Tags":["primary","v1","public-test.example.com/foo/bar"],"Address":"127.0.0.1","Meta":null,"Port":8000,"Weights":{"Passing":1,"Warning":1},"EnableTagOverride":false,"Proxy":{"MeshGateway":{},"Expose":{}},"Connect":{},"CreateIndex":9,"ModifyIndex":9},"Checks":[]}]%
```

I have tried to add double quotes to my filter in the service resolver config but I was not able to make it works.

```
{
"ConnectTimeout": "5s",
"Kind": "service-resolver",
"Name": "service2",
"Subsets": {
"public-testexamplecomfoobar": {
"Filter": "\"public-test.example.com/foo/bar\" in Service.Tags"
}
}
}
```

I always got a 503 with `no healthy upstream`.

### Consul info for both Client and Server

Server info

```
agent:
check_monitors = 0
check_ttls = 0
checks = 0
services = 0
build:
prerelease =
revision = 10bb6cb3
version = 1.9.4
consul:
acl = disabled
bootstrap = false
known_datacenters = 1
leader = true
leader_addr = 127.0.0.1:8300
server = true
raft:
applied_index = 19
commit_index = 19
fsm_pending = 0
last_contact = 0
last_log_index = 19
last_log_term = 2
last_snapshot_index = 0
last_snapshot_term = 0
latest_configuration = [{Suffrage:Voter ID:e999d428-1309-44ed-154f-ddaa8ea736e4 Address:127.0.0.1:8300}]
latest_configuration_index = 0
num_peers = 0
protocol_version = 3
protocol_version_max = 3
protocol_version_min = 0
snapshot_version_max = 1
snapshot_version_min = 0
state = Leader
term = 2
runtime:
arch = amd64
cpu_count = 8
goroutines = 85
max_procs = 8
os = darwin
version = go1.15.8
serf_lan:
coordinate_resets = 0
encrypted = false
event_queue = 1
event_time = 2
failed = 0
health_score = 0
intent_queue = 0
left = 0
member_time = 1
members = 1
query_queue = 0
query_time = 1
serf_wan:
coordinate_resets = 0
encrypted = false
event_queue = 0
event_time = 1
failed = 0
health_score = 0
intent_queue = 0
left = 0
member_time = 1
members = 1
query_queue = 0
query_time = 1
```

### Operating system and Environment details

Linux amd64 with debian 9 and mac OS

envoy version: e98e41a8e168af7acae8079fc0cd68155f699aa3/1.16.2/clean-getenvoy-486d4e2-envoy/RELEASE/BoringSSL