Add metadata fallback for client sidecar reporters

[keithmattix]

What this PR does / why we need it: Companion to istio/istio#54383. Use MX fallback if there's no ssl context for the upstream connection (there won't be when we're doing CONNECT encap due to the extra internal listener in between). Note that this doesn't help with the source principal; we may be able to set some filter state in the connect_encap listener and have stats read it before we flush, but I'd need to try it out.

[keithmattix]

Long term, I need to see if I can create a lasso of ssl contexts so we don't need WDS fallback for peer principal. I recall @kyessenov saying it's possible, and the way we get http status codes may be a clue

[zirain]

is this covered by a test?

[keithmattix]

is this covered by a test?

Ah forgot to add one in the flurry of PRs; will do

[istio-testing]

@keithmattix: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
test-arm-arm64_proxy	df1c0b7	link	true	/test test-arm-arm64
test-asan_proxy	df1c0b7	link	true	/test test-asan
test_proxy	df1c0b7	link	true	/test test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.