Use tproxy to allow preservation of IP addresses

Nobody has claimed this yet.

## Feature Request

### What problem are you trying to solve?

When traffic arrives at a container in a pod via Linked in, the IP addresses are mangled.

- The pod has to listen on localhost instead of the pod IP (which is a minor issue, but does mean that behaviour may need to differ based on whether a service mesh is present).

- All incoming traffic appears to come from localhost. This impacts logging; can break certain protocols which mandate behaviour based on IP address in use (SIP); and stops blacklisting of IPs for security.

I'd like to address the second of these.

### How should the problem be solved?

The most likely way to fix this is to use TPROXY in iptables rules. Roughly this involves:

- changes to iptables rules;

- giving the proxy container `CAP_NET_ADMIN` privileges;

- changing the proxy container to maintain the source address.

This is an option for istio, with some interesting discussion here: https://github.com/istio/istio/pull/4654.

### Any alternatives you've considered?

I haven't been able to think of any, though open to suggestions.

### How would users interact with this feature?

The use of TPROXY would have to be a Linkerd option, enabled probably globally, both for security reasons (`CAP_NET_ADMIN`) and because of environment specific issues with kernel modules such as https://github.com/istio/istio/issues/22500

Start by reviewing Linkerd's iptables rules and proxy-container configuration, then read the linked Istio discussion and kernel-module issue for TPROXY constraints. Define the required option scope, CAP_NET_ADMIN implications, and source-address preservation behavior before implementation; done means the feature works without breaking environments where TPROXY is unavailable.

Written by the indexing model from the issue text.