Title: Allow changing healthy panic scenarios to failing all requests instead of routing to any host.

Description:
Currently, the only behavior possible when a cluster enters a panic state is that requests are routed to any host in the cluster regardless of the host's health. This behavior should be configurable to instead disallow requests completely, even with remaining healthy hosts in the cluster. This is useful in scenarios where it is more desirable to allow a failing service to recover, rather than attempt to allow even a small percentage of traffic to succeed.

I also have a draft patch which switches the behavior unconditionally and would be willing to work on adapting it to be configurable.

Relevant Links:
https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/panic_threshold.html