Treat TLS inspector as proper filter in filter chain, add it in control plane

[kdorosh]

Is your feature request related to a problem? Please describe.
Envoy used to automatically include/inject the TLS inspector, but that was removed in envoyproxy/envoy#14404. In solo-io#4041 we used runtime flags to use the older behavior, but we should remove those soon in favor of adding the filter in Gloo itself.

Describe the solution you'd like
Remove the runtime flags and add support for TLS inspector in Gloo itself; beef up testing (this was caught in upgrade to latest master envoy in our knative regression tls suite, would have been nice to debug in a simpler test)

[EItanya]

We already add this as part of failover in certain scenarios. So we should make sure to remove it from there when we add this.