Title: xDS gRPC credentials for AWS IAM

Description:
I work on the AWS App Mesh team. For our public preview we added a core.GrpcService.GoogleGrpc.CallCredentials plugin that uses a slightly modified signature v4 signing process to authenticate xDS requests. Essentially, we map the gRPC POST request into an HTTP 1.1-style request and pass follow the signing algorithm as documented.

We'd like to contribute this plugin into upstream Envoy to allow users to easily make their own builds and get timely feature updates/bugfixes etc.

Our current implementation pulls in a (opt-in) dependency on the core library of AWS C++ SDK, which is probably overkill. It also relies on linking the SDK against openssl and libcurl to perform the necessary HTTP requests to fetch credentials from places like the EC2 instance metadata endpoint.

I was exploring dropping the AWS SDK dependency and passing a context object to the Envoy::Grpc::GoogleGrpcCredentialsFactory with a cluster manager so that we could leverage Envoy's HTTP apis to call to the metadata endpoints, but I'm worried I'm going down the completely wrong path to making REST api calls from within the CredentialsFactory.

Any suggestions? I'm happy to open a PR with the current implementation, but I'm sure a minimalist AWS-auth lib in Envoy could be handy for other extensions that may need to communicate with AWS services. ex: #4526