transport: reject requests missing :authority and host headers (#9365)

Fixes : https://github.com/grpc/grpc-go/issues/9354

This PR updates the HTTP/2 transport layer to reject requests missing
both :authority and Host headers early. Also adds a defensive check in
xds server to ensure authority header is present.

RELEASE NOTES: 
- server: Reject requests missing both `:authority` and `Host` headers
with HTTP 400 and status `Internal`

---------

Co-authored-by: Madan Kumar <winklemad@outlook.com>