Need support for http/2 CONNECT upgrade

**Setup:**
We have a dual envoy proxy setup. A front envoy (v1.12.2) configured by a custom XDS for global routing and then the second layer (v1.16.2) configured with Contour as a single cluster ingress controller.

**Problem:**
We are trying to enable web-socket support at both levels. Have been able to successfully enable it directly at the second level (Contour) with the `enableWebsockets` flag on the HttpProxy resource. But since the connection between the two envoys is http/2, I fear the websocket upgrade is being rejected. From envoy's [documentation](https://www.envoyproxy.io/docs/envoy/v1.16.2/intro/arch_overview/http/upgrades.html?highlight=websocket#websocket-over-http-2-hops) looks like the second envoy (Contour in this case) needs to allow CONNECT upgrades.

**Feature Request:**
Ability to add `CONNECT` type in `UpgradeConfig` and set `allow_connect` flag in `Http2ProtocolOptions `. We might need something similar to [this](https://github.com/giri-vmw/contour/commit/bd169c63e6b83b8893c9685cb08d0b99c1cf6ed1?branch=bd169c63e6b83b8893c9685cb08d0b99c1cf6ed1&diff=split#diff-3ac78a572d7c77edc33d29cab859f054045a0efd13d26542d56a0477866b8e6fR301) change. But please note that the change does not work. So, there could be other settings that I am missing.

Please let me if you need more info.

Start by tracing how Contour produces Envoy UpgradeConfig and Http2ProtocolOptions for an HttpProxy with enableWebsockets, then compare those settings with Envoy's websocket-over-HTTP/2 upgrade documentation. Done means CONNECT upgrades are represented and generated correctly for the dual-Envoy setup, with websocket behavior verified rather than relying only on the referenced change.

Written by the indexing model from the issue text.