xds: Support UpstreamTlsContext.sni with XdsChannelCredentials

[ejona86]

gRFC A29 added XdsChannelCredentials, but the gRFC explicitly ignored the sni field. @dvilaverde in #11750 needs sni, so this issue was split out to track it. We'll need a small gRFC.

The current implementation is sending sni based on the original target instead of not sending any SNI. That's not good as it could cause a user to unknowingly depend on the incorrect behavior. So we do need to at least disable SNI in the short-term. But it seems the work to disable SNI is most of the work to support sni. (Even when we support sni we need to support disabling SNI; if the field is empty that implies SNI is disabled.)