We don't currently have the ability to shut down Envoy instances safely once they're started up. An interface should be exposed to safely terminate instances, performing any necessary cleanup and calling appropriate callback handlers.

cc @goaway @junr03