Add an option (policy) to enforce mTLS for outbound traffic

@kflynn is already working on this.

Since Aug 28, 2026.

### What problem are you trying to solve?

A meshed client will send plaintext traffic when a Kubernetes Service points to a non-meshed pod.
For example, a Service initially points to a meshed server. If its selector or endpoints are changed to point to a non-meshed pod, the client’s Linkerd proxy receives no destination identity and connects without mTLS.
Inbound authorization does not protect against this because the traffic no longer reaches the original server.
I need a way for clients to require mTLS and fail closed when the destination is not meshed.

### How should the problem be solved?

Add an outbound policy that requires mTLS for selected Services or workloads.
When enabled, the outbound proxy should reject the connection if:
- The destination has no Linkerd identity.
- mTLS cannot be established.
Linkerd should never fall back to plaintext when this policy applies.

### Any alternatives you've considered?

Inbound authorization can require authenticated traffic at the server, but it does not protect the client if a Service is redirected to another backend.
Kubernetes NetworkPolicy can restrict network access, but it cannot verify a Linkerd destination identity or guarantee that traffic uses Linkerd mTLS.

### How would users interact with this feature?

A simple namespace or workload annotation could require mTLS:
```
metadata:
annotations:
config.linkerd.io/default-outbound-policy: all-authenticated
```

Or A set of CRDs that specify fine-grained policy for specific ports, routes, workloads, etc.

### Would you like to work on this feature?

maybe