Add support for TLS Passthrough

[rainest]

What this PR does / why we need it:
Adds support for TLS Passthrough by not doing much of anything. Turns out we already run the route override() function on all routes, regardless of what kind of Ingress-like they came from, so editing the allowed protocols string and slapping a konghq.com/protocols annotation on a TCPIngress is sufficient.

This mostly adds tests:

• Several invalid TCPIngress unit tests
• Regular TLS TCPIngress integration with multiple TCPIngresses differentiated by SNI
• TLS passthrough integration

Which issue this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close that issue when PR gets merged): fixes #2023
fixes #1179

Special notes for your reviewer:

This is a draft because Kong 2.7 is not yet released, and current versions of Kong do not accept the tls_passthrough protocol. It includes a temporary commit to use a nightly and use a modified version of go-kong that doesn't break on nightly release version strings. Once 2.7 is released, we can remove this.

This will also require a new release of KTF that includes Kong/kubernetes-testing-framework@276b0c6

passthrough_test.txt shows a single test run.

PR Readiness Checklist:

Complete these before marking the PR as ready to review:

• the CHANGELOG.md release notes have been updated to reflect any significant (and particularly user-facing) changes introduced by this PR

[github-actions]

Licenses differ between commit 63f2b68 and base:

+++ pr_licenses.csv	2021-11-30 21:57:05.087436178 +0000
@@ -8,7 +8,12 @@
 github.com/bombsimon/logrusr,https://github.com/bombsimon/logrusr/blob/master/LICENCE,MIT
 github.com/cenkalti/backoff/v4,https://github.com/cenkalti/backoff/blob/master/v4/LICENSE,MIT
 github.com/cespare/xxhash/v2,https://github.com/cespare/xxhash/blob/master/v2/LICENSE.txt,MIT
+github.com/containerd/containerd,https://github.com/containerd/containerd/blob/master/LICENSE,Apache-2.0
 github.com/davecgh/go-spew/spew,https://github.com/davecgh/go-spew/blob/master/spew/LICENSE,ISC
+github.com/docker/distribution,https://github.com/docker/distribution/blob/master/LICENSE,Apache-2.0
+github.com/docker/docker,https://github.com/docker/docker/blob/master/LICENSE,Apache-2.0
+github.com/docker/go-connections,https://github.com/docker/go-connections/blob/master/LICENSE,Apache-2.0
+github.com/docker/go-units,https://github.com/docker/go-units/blob/master/LICENSE,Apache-2.0
 github.com/evanphx/json-patch,https://github.com/evanphx/json-patch/blob/master/LICENSE,BSD-3-Clause
 github.com/evanphx/json-patch/v5,https://github.com/evanphx/json-patch/blob/master/v5/LICENSE,BSD-3-Clause
 github.com/fatih/color,https://github.com/fatih/color/blob/master/LICENSE.md,MIT
@@ -39,6 +44,8 @@
 github.com/mitchellh/reflectwalk,https://github.com/mitchellh/reflectwalk/blob/master/LICENSE,MIT
 github.com/modern-go/concurrent,https://github.com/modern-go/concurrent/blob/master/LICENSE,Apache-2.0
 github.com/modern-go/reflect2,https://github.com/modern-go/reflect2/blob/master/LICENSE,Apache-2.0
+github.com/opencontainers/go-digest,https://github.com/opencontainers/go-digest/blob/master/LICENSE,Apache-2.0
+github.com/opencontainers/image-spec/specs-go,https://github.com/opencontainers/image-spec/blob/master/specs-go/LICENSE,Apache-2.0
 github.com/pkg/errors,https://github.com/pkg/errors/blob/master/LICENSE,BSD-2-Clause
 github.com/prometheus/client_golang/prometheus,https://github.com/prometheus/client_golang/blob/master/prometheus/LICENSE,Apache-2.0
 github.com/prometheus/client_model/go,https://github.com/prometheus/client_model/blob/master/go/LICENSE,Apache-2.0```

[rainest]

Attached are archived runs of integration tests before I reverted the nightly hack and added the version gate. The version gate skips the new integration tests on current versions:

logs_20332-pg.zip
logs_20332.zip

Enterprise was failing because of #2070 but wasn't of interest because I didn't have an Enterprise nightly to test against.

[mflendrich]

LGTM; I just think that suppressing tests should be opt-in (rather than the default) if obtaining the Kong semver fails. See the attached comment.

[mflendrich]

Looks good! A few minor bits, otherwise good to go 👍