This is a redo of #5618.

1. Turn on h2 upgrade when mTLS is turned on and the destination policy is ISTIO_MUTUAL.
   This guarantees that the other side is Istio and it is safe to upgrade to h2.
2. Ensure that h2 upgrade is only done when the destination is http/1.1. (that is do not upgrade from tcp, tcp over h2 is not supported yet)
3. Ensure that ALPN is specified when h2 is already set. This ensures that correct negotiations take place.