This is done through standard HTTP/2 pooling.
The pooling is keyed off the `{source identity, destination identity, destination ip}`.

### Headers

Ztunnel uses the following well-known headers in HBONE:

  // contain duplicate certificates, or that use PEM block headers.
  //
  // Users of ClusterTrustBundles, including Kubelet, are free to reorder and
  // deduplicate certificate blocks in this file according to their own logic,
  // as well as to drop PEM block headers and inter-block data.
  optional string trustBundle = 2;

                          nullable: true
                          type: boolean
                        allowHeaders:
                          description: List of HTTP headers that can be used when
                            requesting the resource.
                          items:
                            type: string
                          type: array

                          nullable: true
                          type: boolean
                        allowHeaders:
                          description: List of HTTP headers that can be used when
                            requesting the resource.
                          items:
                            type: string
                          type: array

	}
	if match.GetPath() != "" {
		conds = append(conds, match.GetPath())
	}
	if match.GetSafeRegex() != nil {
		conds = append(conds, fmt.Sprintf("regex %s", match.GetSafeRegex().Regex))
	}
	// Ignore headers
	return strings.Join(conds, " ")
}

// PrintListenerDump prints the relevant listeners in the config dump to the ConfigWriter stdout

                            "typed_config": {
                              "@type": "type.googleapis.com/envoy.extensions.filters.http.set_filter_state.v3.Config",
                              "on_request_headers": [
                                {
                                  "object_key": "envoy.filters.listener.original_dst.local_ip",
                                  "format_string": {

Resource Sharing policy (CORS). properties: allowCredentials: description: Indicates whether the caller is allowed to send the actual request (not the preflight) using credentials. nullable: true type: boolean allowHeaders: description: List of HTTP headers that can be used when requesting the resource. items: type: string type: array allowMethods: description: List of HTTP methods allowed to access the resource. items: type: string type: array allowOrigin: items: type: string type: array allowOrigins:...

		if match.IgnoreUriCase {
			retval += " uncased"
		}
	}

	if len(match.Headers) > 0 {
		headerConds := []string{}
		for key, val := range match.Headers {
			headerConds = append(headerConds, fmt.Sprintf("%s=%s", key, renderStringMatch(val)))
		}
		retval += " when headers are " + strings.Join(headerConds, "; ")
	}

	// TODO QueryParams, maybe Gateways
	return strings.TrimSpace(retval)

  //
  // Validation requirements:
  //  1. certificate must contain one or more PEM blocks.
  //  2. All PEM blocks must have the "CERTIFICATE" label, contain no headers, and the encoded data
  //   must be a BER-encoded ASN.1 Certificate structure as described in section 4 of RFC5280.
  //  3. Non-PEM content may appear before or after the "CERTIFICATE" PEM blocks and is unvalidated,

            "stat_prefix": "connect_originate",
            "cluster": "connect_originate",
            "tunneling_config": {
             "hostname": "%DOWNSTREAM_LOCAL_ADDRESS%",
             "headers_to_add": [
              {
               "header": {
                "key": "baggage",