allow fallback to default filter chain when listener filters timeout

[lizan]

Description:
Currently the timeout for listener filters behaves:

The timeout to wait for all listener filters to complete operation. If the timeout is reached, the accepted socket is closed without a connection being created. Specify 0 to disable the timeout

There should be a configurable option allow this to fallback to a default filter chain (the filter chain with empty filter chain match) when they timeout.

[lizan]

cc @rshriram @louiscryan

[incfly]

Mind providing more context on use case why listener filter can time out? One thing I've experienced, not sure if it's scoped in this FR, is the tls_inspector can sometimes get stuck if the tls handshake is initiated in from server side, for that very reason, the Istio PERMISSIVE mode does not work for MySQL.

[rshriram]

thats what @lizan is talking about.. For mysql,, the filter will wait for data from client forever.. Instead, it should timeout and fallback to some default filter chain.

[incfly]

Sounds great, this can benefit Istio directly.

If Envoy folks also think this generic useful feature, I'm interested in helping on this one (very closed to wrap a PR for another FR, #7111).