Handling severe errors

[Tratcher]

#357 (comment)

There are some severe error conditions that we need to come up with a consistent, extensible policy for addressing. Some examples:

1. Fail to load config data at startup. Current behavior: throw with intent to crash the app.
2. Fail to reload config data. Current behavior: Log and keep running with the last known good config. Some of these errors will prevent the proxy from listening for future config changes because IChangeToken is single use.

An application developer may want to FailFast the app or trigger a graceful shutdown in the case of a config reload failure, but app lifetime should be something controlled by the developer, not by the ReverseProxy library. We may need to provide extensibility points where the developer can handle these errors in their own way.

[karelz]

Triage: We need to decide what is the right API/behavior. FailFast is likely not a good behavior.

[karelz]

Triage: This does not seem to be blocking @davidni (right?), moving to Backlog ...