it'd be ideal if https://www.envoyproxy.io/docs/envoy/latest/api-v1/cluster_manager/cluster_ssl
sni field supported an "automatic" mode where the sni sent is the authority of the captured http traffic

(this would allow to write wildcard rules for istio and still have outbound sni work)

followup from #2670 (comment)