This is a follow up to #2778

The control plane side of things is being implemented in #2807, which adds the flag linkerd inject --disable-tap (currently hidden) and the corresponding annotation config.linkerd.io/disable-tap, which the proxy injector detects to add LINKERD2_PROXY_TAP_DISABLED=true in the env vars for the injected container. It also forbids our API to tap into any pod with that annotation.

This issue tracks the work on the proxy-side.