TLS docs do not mention that the subject alt name is not verified by default

[jeid64]

Title: TLS docs do not mention that the subject alt name is not verified by default

Description:
https://www.envoyproxy.io/docs/envoy/v1.8.0/intro/arch_overview/ssl#enabling-certificate-verification
The documentation is a little confusing and leads people to believe that if they only enable trusted_ca, they'll actually be verifying the alternative name on the cert.

See:
"/etc/ssl/certs/ca-certificates.crt is the default path for the system CA bundle on Debian systems. This makes Envoy verify the server identity of 127.0.0.2:1234 in the same way as e.g. cURL does on standard Debian installations."
from https://www.envoyproxy.io/docs/envoy/v1.8.0/intro/arch_overview/ssl#enabling-certificate-verification

However, the default behavior for curl is to verify that the subject name matches the DNS name connected to, which this example does not. Instead, it's only verifying that the cert presented can be validated against the entire Debian CA bundle. I think the example should be updated to add verify_subject_alt_name and mention that otherwise anyone can present any publicly signed cert and Envoy will accept it.

[mattklein123]

Agreed we can/should do better here. Doc PRs appreciated to add warnings, links, etc.