Ability for Linkerd Proxy to use custom certificates when connection is not from another Linkerd Proxy

Nobody has claimed this yet.

## Feature Request

### What problem are you trying to solve?

A service is not able to utilize its existing certificate and the Linkerd certificate at the same time. If an existing service wants to start using certificates provided by the Linkerd proxy, but is currently serving up its own certificate, then the clients in the cluster must change to use the Linkerd certificates or leave the cluster and re-enter through an ingress controller that knows about the existing certificate.

### How should the problem be solved?

It would be nice to on-board a service to Linkerd transparently. This could be solved by allowing the service to give its existing certificate to the Linkerd proxy. This way it could use its Linkerd certificate if talking with another Linkerd proxy else use the client provided certificate.

### Any alternatives you've considered?

Change each client to leave the cluster and come in through the ingress like other clients outside the cluster. This is not transparent and less performant.

Have the service create another proxy for the old service name that terminates the old certificate and then uses Linkerd from it to the new service. Then, have each client update to use either the Linkerd certificates or use *alternate 1*. This allows for transparent on-boarding, but will not get a lot of the service mesh monitoring provided by Linkerd until each client updates its service.

### How would users interact with this feature?

Users could provide a k8s tls secret name to linkerd inject that it would use as the alternate cert when not talking to another linkerd proxy. i.e. `linkerd inject mydeployment.yml --alternate-tls-cert-secret-name my-tls-secret`. The name of the option could use a better name.

Start with the `linkerd inject` command and the proposed `--alternate-tls-cert-secret-name` option. Done means a deployment can supply a Kubernetes TLS secret and the proxy uses that certificate for connections not coming from another Linkerd proxy while retaining Linkerd certificates for proxy-to-proxy traffic.

Written by the indexing model from the issue text.