EPP should gracefully rollout and drain

[smarterclayton]

The EPP is part of an active-active system and should have hitless rollouts.

Any particular EPP must drain during shutdown all requests such that the longest running active request completes as long as it is on the critical path for startup (future changes such as splitting the algorithm or queueing may reduce the delay for the EPP, but not the need).

Tested in a GKE specific context here, I would expect all integrating gateways to understand this is part of the gateway protocol when consuming the EPP directly.