Commit Message:
Allow HTTP/2 (and HTTP/3) upstream servers to half close the stream before the downstream. This enables bidirectional gRPC streams where server completes streaming before the client. Behavior of HTTP/1 or TCP proxy upstream servers is unchanged and the stream is reset if the upstream server completes response before the downstream. The stream is also reset if the upstream server responds with an error status before the downstream. This behavior is disabled by default and can be enabled by setting the envoy.reloadable_features.allow_multiplexed_upstream_half_close runtime key to true.

Change details:
Presently there are two places where the stream was reset when upstream half-closed.

1. In the router filter's Filter::onUpstreamComplete method, which covers HTTP upstreams.
2. In the filter manager's FilterManager::commonEncodePrefix which covers local reply's by filters and TCP upstreams.

When the envoy.reloadable_features.allow_multiplexed_upstream_half_close is enabled the router filter no longer forces reset in the Filter::onUpstreamComplete and allows fully independent half closes. To preserve existing half close behavior of HTTP/1 protocol the force reset is added in the H/1 codec's ClientConnectionImpl::onMessageCompleteBase() method.

When the envoy.reloadable_features.allow_multiplexed_upstream_half_close is enabled the filter manager closes stream after both decoder and encoder filter chain complete, except in two cases:

1. local reply - behaves the same.
2. error (non 1xx or 2xx) response from the server. This case is handled in the FilterManager::checkAndCloseStreamIfFullyClosed() method.

The state_.decoder_filter_chain_complete_ is added to track completion of the decoder filter chain.

To preserver behavior for TCP upstream the force reset is moved into the TcpUpstream::onUpstreamData method.

Risk Level: High (flag protected, disabled by default)
Testing: Unit Tests
Docs Changes: No
Release Notes: Yes
Platform Specific Features: N/A
Runtime guard: envoy.reloadable_features.allow_multiplexed_upstream_half_close
Fixes #30149

Request variables

Key	Value
ref	1987369
sha	d965ff6
pr	34461
base-sha	bd5bec9
actor	@yanavlasov
message	Allow multiplexed upstream servers to half close the stream before the downstream...
started	1724682697.869396
target-branch	main
trusted	false

Container image/s (as used in this CI run)

Envoy version (as used in this CI run)