feat: add outbound mTLS-required default policy

[gnarlex]

Problem

The outbound proxy always falls back to a cleartext connection when a target endpoint has no mesh identity (i.e. is not meshed). Operators who want to restrict a workload to only communicate with meshed targets (or targets outside the cluster) cannot enforce this: unmeshed, in-cluster destinations are silently reached in the clear.

Solution

Add LINKERD2_PROXY_OUTBOUND_DEFAULT_POLICY, the outbound counterpart to LINKERD2_PROXY_INBOUND_DEFAULT_POLICY. Whether a target is meshed is only known once an endpoint is resolved (a meshed endpoint carries a mesh identity in its discovery metadata), so the policy is enforced at connect time by a new RequireMeshIdentity guard in the shared TCP connect stack. The guard refuses a cleartext connection when discovery provided no mesh identity for the endpoint
(ConditionalClientTls::None(NotProvidedByServiceDiscovery)).

Supported values:

• all-unauthenticated (default): unchanged; cleartext permitted.
• all-authenticated: require mTLS for every outbound endpoint.
• cluster-authenticated: require mTLS only for endpoints within LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS; egress outside the cluster is permitted in the clear.

Other cleartext reasons (loopback, identity disabled, ingress without discovery) are never refused, and the default (all-unauthenticated) is byte-for-byte unchanged.

Validation

Added unit tests for env parsing (accepted values, the cluster-networks requirement, rejected values, unset) and behavioral tests for the connect-time guard (in-cluster unmeshed refused; out-of-cluster unmeshed permitted under cluster-authenticated; all-authenticated refuses any unmeshed target; non-discovery cleartext permitted; default never refuses).

---

Fixes linkerd/linkerd2#15615

[thesw4rm]

I'm not currently associated to this project. I was hoping to make my first contribution here. Please feel free to ignore my review!

[thesw4rm]

Brand new to this project, with some Rust experience. Can we fix the variable names?

Suggested change

	let connect = ConnectTcp::new(
	self.config.proxy.connect.keepalive,
	self.config.proxy.connect.user_timeout,
	));
	);
	let requirement = Requirement::new(
	self.config.default_policy,
	self.config.cluster_networks.clone(),
	);
	let connect = PreventLoopback(RequireMeshIdentity::new(connect, requirement));
	let connect = ConnectTcp::new(
	self.config.proxy.connect.keepalive,
	self.config.proxy.connect.user_timeout,
	);
	let tlsAuthRequirement = Requirement::new(
	self.config.default_policy,
	self.config.cluster_networks.clone(),
	);
	self.clone().with_stack(
	PreventLoopback(RequireMeshIdentity::new(connect, requirement))
	)

[thesw4rm]

Requirement on its own might not be descriptive enough. Maybe

Suggested change

	enum Requirement {
	enum TLSAuthRequirement

[thesw4rm]

Suggested change

	requirement: Requirement,
	tlsAuthRequirement: TLSAuthRequirement,