Commit Message: upstream: force h1 for websocket upgrades when allow_connect is false on auto_config clusters

Additional Description:

When a cluster uses http_protocol_options auto_config (for ALPN-based codec selection)
and the upstream supports both h1 and h2, websocket upgrade requests that originated downstream
as h1 upgrades are proxied to the upstream as HTTP/2 connections over extended CONNECT even when the
http2_protocol_options allow_connect flag is disabled.

These upgrades should be proxied as-is to the upstream as h1 websocket upgrade requests
when connect is flagged as supported by the upstream. This matches the docs for
allow_connect: Allows proxying Websocket and other upgrades over H2 connect.

This patch makes h1 websocket upgrades always use the h1 pool with ALPN-based pool selection
when allow_connect is not enabled. Non-ALPN-based clusters, clusters with allow_connect enabled,
non-websocket-upgrade-requests, etc are not changed.

Risk Level: medium: chance of breaking existing users who depend on these off-spec upgrades
Testing: included
Docs Changes: n/a
Release Notes: included
Platform Specific Features: n/a

(claude code assisted with parts of the changes)

Request variables

Key	Value
ref	3a77ebb
sha	f15563a
pr	44317
base-sha	7367e6c
actor	@AdamEAnderson
message	upstream: force h1 for websocket upgrades when allow_connect is false on auto_config clusters...
started	1775667491.858319
target-branch	main
trusted	false

Container image/s (as used in this CI run)

Envoy version (as used in this CI run)