v1.36.0

**Summary of changes**:

  * HTTP:
    - Changed default HTTP/2 max concurrent streams from unlimited to 1024,
    initial stream window from 256MiB to 16MiB, and connection window from
    256MiB to 24MiB for improved memory safety.
    - Added HTTP/1.1 proxy transport RFC 9110 compliant ``CONNECT`` requests
    with ``Host`` header by default.
    - Enhanced route refresh to trigger tracing refresh, applying new
    route's sampling and decoration to active spans.
    - Added support for decompressed HTTP header bytes tracking in access
    logs.
    - Added stream flush timeout configuration independent of stream idle
    timeout.
    - Added header removal based on header key matching patterns.
    - Added per-route compressor library override support.
    - Added ``upstream_rq_per_cx`` histogram for connection reuse
    monitoring.

  * Security & TLS:
    - Fixed TLS inspector regression that closed plain text connections when
    reading >16KB at once.
    - Fixed use-after-free in DNS cache when ``Host`` header is modified
    between filters.
    - Fixed listener socket creation failures in different Linux network
    namespaces.

  * Load Balancing & Networking:
    - Moved locality weighted round robin structures out of ``HostSetImpl``
    into separate classes.
    - Added support for weighted cluster hash policies for consistent
    session affinity.
    - Fixed client-side weighted round robin load balancer priority
    iteration issues.
    - Added network namespace filepath support to socket addresses for
    containerized environments.
    - Enhanced network namespace input matching for RBAC and filter chain
    selection.

  * External Processing & Authentication:
    - Re-enabled ``fail_open`` + ``FULL_DUPLEX_STREAMED`` configuration
    combination.
    - Added per-route gRPC service override and retry policy support for
    ext_authz.
    - Added configurable HTTP status codes on ext_proc errors and TLS alerts
    on network ext_authz denials.
    - Added OAuth2 token encryption disable option for trusted environments.
    - Enhanced header count validation after mutations in ext_authz.

  * Observability & Stats:
    - Added support for removing unused metrics from memory with
    configurable eviction intervals.
    - Added stateful session filter statistics for routing outcome
    monitoring.
    - Added upstream connection recording option to HTTP tap filter.
    - Added GeoIP database build timestamp tracking.
    - Added OAuth2 response code details for ``401`` local responses.
    - Added OTLP stat sink resource attributes and custom metric
    conversions.

  * Dynamic Modules & Extensions:
    - Added logging ABI for modules to emit logs in standard Envoy logging
    stream.
    - Added support for counters, gauges, histograms in dynamic modules API.
    - Added new Redis commands including ``COPY``, ``RPOPLPUSH``, ``SMOVE``,
    ``SUNION``, and others.
    - Added reverse tunnel support for NAT/firewall traversal
    (experimental).

  * Runtime & Configuration:
    - Enhanced rate limit filter with substitution formatter support at
    stream complete phase.
    - Added support for request payloads in HTTP health checks.

  * Notable Fixes:
    - Fixed TCP proxy idle timeout handling for new connections.
    - Fixed UDP proxy crash during ``SIGTERM`` with active tunneling
    sessions.
    - Fixed HTTP/3 access log skipping for half-closed streams.
    - Fixed premature stream resets causing recursive draining and potential
    stack overflow.
    - Fixed OAuth2 cookie handling in pass-through matcher configurations.

**Docker Images**:
    [hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.36.0](https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.36.0)
**Docs**:
    [www.envoyproxy.io/docs/envoy/v1.36.0/](https://www.envoyproxy.io/docs/envoy/v1.36.0/)
**Release Notes**:
    [www.envoyproxy.io/docs/envoy/v1.36.0/version_history/v1.36/v1.36.0](https://www.envoyproxy.io/docs/envoy/v1.36.0/version_history/v1.36/v1.36.0)
**Full Changelog**:
    [github.com/envoyproxy/envoy/compare/v1.35.0...v1.36.0](https://github.com/envoyproxy/envoy/compare/v1.35.0...v1.36.0)

Signed-off-by: Ryan Northey <ryan@synca.io>
Signed-off-by: Rohit Agrawal <rohit.agrawal@databricks.com>
Signed-off-by: Boteng Yao <boteng@google.com>