Escape hatch overrides support in service-defaults

It would be useful to support [escape hatch overrides](https://www.consul.io/docs/connect/proxies/envoy#escape-hatch-overrides) configuration in service-defaults.

Use cases:
- Useful to override envoy configs in kubernetes.
- We can set envoy configs at the service level rather than per instance level via [sidecar_service](https://www.consul.io/docs/connect/registration/sidecar-service) block. Helpful for VM workloads.
- Helpful to customize envoy to set up access logging, timeouts, circuit breakers, etc.

Currently we have option to do this via [proxy-defaults](https://www.consul.io/docs/connect/config-entries/proxy-defaults#config) but service level options would be more helpful especially since configs would differ from service to service.
Also [connect-proxy](https://www.consul.io/docs/connect/registration/service-registration) does not seem to be suitable for kubernetes workloads.

Start by comparing the service-defaults and proxy-defaults configuration entries, then review the linked escape hatch overrides and sidecar_service documentation. Define how service-level Envoy overrides should work for Kubernetes and VM workloads; done means service-defaults supports the requested configuration and the documented use cases are covered.

Written by the indexing model from the issue text.