Support Contour Envoy External Authorization

## Describe the feature
Contour supports envoy's external authorization feature through the ExtensionService resource and it would a great add-on to knative serving to support this feature within its core configuration.

For example, support a contour knative config map that can define a default ExtensionService used by all knative services. Also support a service level annotation that disables the use of the ExtensionService.

Start by tracing how Contour ExtensionService resources and Knative configuration are represented, then identify the configuration entry point for a default service-wide setting. Define how a Contour config map selects the default ExtensionService and how a service-level annotation disables it. Done means both configuration paths are supported and covered by tests.

Written by the indexing model from the issue text.