Use prepend_policy or similar in preference to mark_circuit_unusable_for_new_conns
For some error cases, probably including END_STREAM_REASON_TIMEOUT, END_STREAM_REASON_RESOLVEFAILED, END_STREAM_REASON_CONNECTREFUSED, our current practice of tracking failures with client_dns_incr_failures and marking the whole circuit as unusable for connections is probably no good.
After all, a TIMEOUT can just mean that the particular address was filtered, or that it legitimately timed out, or something like that.
Instead, we should use prepend_policy or some similar mechanism to mark that circuit, not as unsuitable for all new streams, but as simply unsuitable for the particular address. (I say "something like prepend_policy" and not "prepend_policy" because we should really drop the original hostname and not just the resolved address.) We might want to keep a counter of the number of successful and failed streams per circuit.
This is going to be important if we make more failure types retriable (#7870 (moved)).