v1.38.6

**Summary of changes**:

* Security fixes:
  - [GHSA-8vc2-jrm4-835w](https://github.com/envoyproxy/envoy/security/advisories/GHSA-8vc2-jrm4-835w):
    oauth2: crash on requests without a `:path` header (i.e. CONNECT). The filter now rejects such requests with `400`.
  - [GHSA-47vj-9r25-wv5j](https://github.com/envoyproxy/envoy/security/advisories/GHSA-47vj-9r25-wv5j):
    api_key_auth: crash when `hide_credentials` is enabled with a `query` key source and a request without a `:path` header (i.e. CONNECT) is authenticated via another key source.

**Docker images**:
    https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.38.6
**Docs**:
    https://www.envoyproxy.io/docs/envoy/v1.38.6/
**Release notes**:
    https://www.envoyproxy.io/docs/envoy/v1.38.6/version_history/v1.38/v1.38.6
**Full changelog**:
    https://github.com/envoyproxy/envoy/compare/v1.38.5...v1.38.6

Signed-off-by: wbpcode <wbphub@gmail.com>
Signed-off-by: Ryan Northey <ryan@synca.io>
Signed-off-by: Kateryna Nezdolii <kateryna.nezdolii@gmail.com>