Add envoy-only egress mode (for networks)

We might want to restrict what egress a service has and essentially force it route through envoy, if it wants/requires egress traffic

I think it should be doable from the docker side.

The main thing that would need to be added i think is a hidden network for envoy egress, or perhaps envoy would just need to be on a network allowing egress

however its implemented i can imagine quite a lot of reasons/ways that you would want to restrict egress traffic - esp from services