Title: Mutable server options allows confusing information flow

Description:
An Envoy::ServerImpl is configured with an instance of Envoy::Server::Options. That argument to the ServerImpl constructor is non-const and is passed by reference. This allows the envoy server to mutate the Options class, which seems like the wrong direction for flow of information. Instead, the reference passed to the server should be const to be clear that it is information flowing from the server owner to the server.