In anticipation of tap becoming an APIExtension so that requests to it may be authenticated and authorized, we should split the tap service out of the controller pod.

• The tap pod should serve the TapByResource route of the public API (protobuf over HTTP)
• The public-api service should return a message on the TapByResource route indicating that this has moved.
• The linkerd tap CLI command should make requests to the linkerd-tap service instead of the public-api
• The web process should use a protobuf over HTTP client to make calls to the tap service.