[Chuang Wang (chuangw6)]

Part of #3133. When a reader stalls, the data atunnel, atenet-router and the egress gateway relay waits in kernel socket buffers. That memory counts toward the proxy's memory limit, but no heap profile shows it. This adds a way to measure it, and a design doc with the results.

• benchmarking/atunnel gets four slow-reader scenarios (--scenarios slow), on the egress and CONNECT paths in both directions. They report kernel socket memory per connection. It also gets throughput scenarios for egress download and CONNECT, and new run-docker.sh options: --network-delay and --tunnel-flag. The containers get a GKE node's TCP buffer limits.
• benchmarking/envoy-sockmem is a new benchmark that does the same for an Envoy configured like the router or the egress gateway.
• docs/network-socket-memory.md explains the problem and the options, and gives the results and the defaults.

Kernel socket memory per stalled connection, 100 connections, median of 3:

Who stops reading	Off	TCP_NOTSENT_LOWAT 16 KiB
actor, from a destination, through atunnel	753 KiB	62 KiB
client, from an actor, through the router	981 KiB	57 KiB
destination, from an actor, through the gateway (one tunnel)	1420 KiB	48 KiB

Three follow-up PRs set the option in atunnel, the router and the egress gateway. Not measured on GKE yet; the numbers come from Docker with GKE's TCP buffer limits.

• Tests pass
• Docs updated

[Lior Lieberman (LiorLieberman)]

I think LGTM - lets get #3320 first