Require mTLS for specific deployments or pods

Nobody has claimed this yet.

## Feature Request

### What problem are you trying to solve?

Ensure traffic must come from the mesh, and not leave the mesh, for specific deployments / pods.

### How should the problem be solved?

Introduce an option to have the linkerd-proxy only accept traffic over mTLS, and egress connectivity to other endpoints through mTLS.

This would allow for a mix between linkerd enabled pods that require mTLS on ingress/egress traffic, and pods for which mTLS is optional to be deployed. Pods deployed on the edge of the ingress would be configured with optional ingress mTLS, but would perform all egress traffic using mTLS.

Some challenges may be; only enforcing mTLS to specific identities, or tcp connections rather than http, or traffic leaving the cluster itself.

### Any alternatives you've considered?

n/a

### How would users interact with this feature?

Similar to the automatic proxy injection, using annotations on a namespace, deployment or pod, for example:
- `linkerd.io/force-ingress-tls: 'enabled'`
- `linkerd.io/force-egress-tls: 'enabled'`

Start by examining the linkerd-proxy behavior described in the issue and how namespace, deployment, and pod annotations are handled. Define the supported scope for ingress and egress mTLS, including identities, TCP traffic, and traffic leaving the cluster; done means the selected workloads enforce the documented policy without changing optional mTLS behavior elsewhere.

Written by the indexing model from the issue text.