External Auth Provider in Ingress / Injected Sidecars

Nobody has claimed this yet.

## Feature Request

### What problem are you trying to solve?

In order to standardize authentication patterns across the mesh, one can run external auth at the ingress level; however, in order to address other malicious access patterns, we are also interested in authenticating every request within the mesh between services.

This includes requests that may have already been authenticated on the edge, but potentially also including requests that originated within the mesh.

### How should the problem be solved?

There already exists some support for configuring this at the [ingress level](https://linkerd.io/2/tasks/using-ingress/); however, in order to extend this also for requests within the mesh, this should be configurable by the proxy itself when running as an injected sidecar.

Ideally, the proxy should be able to configure some target for external auth provider, and also provide some standard RPC spec (preferably gRPC) to codify the interface of the external auth provider.

### Any alternatives you've considered?

Technically, this could be achieved by routing every request through the ingress, but that creates additional issue including unnecessary network and cost overhead.

Other alternatives include running other proxies where this might be supported.

### How would users interact with this feature?

I'm not sure what would be the best place to inject this configuration. Perhaps as additional annotation like in the [Automatic Injection](https://linkerd.io/2/tasks/automating-injection/#configuration) example, or perhaps as a Kubernetes custom resource?

Start with the existing ingress-level authentication documentation and the Automatic Injection configuration documentation linked in the issue. Define the proxy-side configuration, external-auth RPC boundary, and injection mechanism before implementation; no source files, tests, or implementation entry points are identified here.

Written by the indexing model from the issue text.