Title: The assertion in Tls::ContextManagerImpl's destructor may sometimes fail.

Description:
When a Tls::ContextManagerImpl is destructed due to an Envoy Server::InstanceImpl being destructed, the ASSERT in the destructor may fail. There's a call immediately above to removeEmptyContexts() which seems to imply that either some contexts are not yet empty and/or removeEmptyContexts() is not performing as expected. Whether this represents an actual bug in the code, or simply an unexpected but benign set of circumstances is unknown.

[Relevant Links:]
For a detailed stack trace, see this Envoy Mobile issue:
envoyproxy/envoy-mobile#572