reduce health check rate if there is active succeeding traffic

This came up from a conversation I think with @snowp at KubeCon/EnvoyCon: we should be able to optionally lower the active health check rate if we are receiving a sufficient amount of passive traffic. As long as the upstream is able to send x-envoy-immediate-health-check-fail (as an upstream Envoy would do), draining should still be possible even in the passive case.

This would potentially mitigate some HC traffic explosion without having to resort to centralized HC.