OptIn Sidecar Injector

Nobody has claimed this yet.

## Feature Request
Support pod level filtering within the mutating webhook and validating webhook configurations so that pods creation events are not globally blocked if linkerd proxy injector or service validator is down.

### What problem are you trying to solve?

We've experienced multiple issues where for one reason or another the linkerd service injector is down. The way we found this is that replicasets were unable to create pods. The error given is that kube-apiserver tried to contact the service injector but was unable to receive a response. This problem is even more significant given that pods in the kube-system namespace are impacted by this without special configurations on the namespace object itself.

### How should the problem be solved?

The procedure to solve this is to use labels for not just namespace selection, but also pod object selection. Linkerd currently uses annotations which can not be filtered on in Mutating or Validating webhooks. This is because labels are used for object, while annotations are for adding metadata. I'm proposing these changes:

1. Change linkerd.io/inject from an annotation to a label.
2. Add support for object selectors to the Webhook configurations [Istio as an example](https://github.com/istio/istio/blob/master/manifests/charts/istio-control/istio-discovery/templates/mutatingwebhook.yaml#L58-L78)

What do you want to happen? Add any considered drawbacks.

There is considerable drawback to this approach. It would be an API incompatibility with the existing linkerd users. We can address this by supporting both annotations and labels for pods, namespaces already correctly used labels. The documentation would include the drawbacks of annotations, while still allowing injection to occur without the label objectSelector.

### Any alternatives you've considered?
We wait until k8s adds support for fieldSelectors in webhooks.

Is there another way to solve this problem that isn't as good a solution?
We ignore pod level events, but make the namespaceSelector configurable in the helm chart. Users can choose an autoinject model, the only option today or an opt in model like is found [here](https://github.com/istio/istio/blob/master/manifests/charts/istio-control/istio-discovery/templates/mutatingwebhook.yaml#L31-L57).

### How would users interact with this feature?
They would use the values.yaml to configure options on the webhook filtering. Users would have the option to do OptIn or OptOut on namespace labels or OptIn or OptOut on pod labels.

If you can, explain how users will be able to use this. Maybe some sample CLI
output?

Start by reviewing the current mutating and validating webhook configurations and values.yaml, then compare the proposed object-selector approach with the linked Istio examples. Determine how namespace and pod filtering, opt-in and opt-out modes, and compatibility with existing annotations should be represented. Done means the webhook filtering options are configurable without globally blocking pod creation when the injector or validator is unavailable.

Written by the indexing model from the issue text.