Implement gRFC A29: xDS-Based Security for gRPC Clients and Servers (#2837, #2866) Fix aggregate cluster behavior (gRFC A75) (#2844) Include validation error details when NACKing invalid resources (#2902) Proactively connect in more cases when using the ring_hash load balancing policy (#2904)