e77fe18 introduced loop detection to the outbound HTTP proxy. This
change extends this behavior to the inbound HTTP proxy and the TCP
proxy for both inbound and outbound. This helps ensure malicious
requests can't consume proxy resources.

This change adds (flakey) tests for loop detection. The tests are flakey
because they require static ports to work properly. (We cannot configure
the original dst port to be the same as the interface port if the
interface port is not known).

This change modifies the fallback layer to inspect error sources
recursively to determine if the given error type is satisfied.

A stack-helper is also added for this case.

This change does not change any functionality. It only restructures the
inbound and outbound proxy modules so that the clients and servers can
be instantiated separately. This will support gatewaying requests between
the inbound and outbound proxy.

When the proxy receives inbound requests without an original dst address
(or with a original dst address matching the inbound listener), the
proxy currently fails these requests.

This change modifies the proxy to attempt to accept these requests and
forward them back through the outbound router.

The gateway requires that all requests are received over an mTLS-secured
connection. It also refines the destination through DNS to determine the
canonical-form name as well as an outbound original dst IP. All
gatewayed destinations must have a suffix as set by the
`LINKERD2_PROXY_INBOUND_GATEWAY_SUFFIXES` environment variable.

All requests that do not meet these criteria are failed with a `403
Forbidden` status.

When the gateway forwards requests, it now adds a `Forwarded` header
including the source identity, the local identity, and the destination
authority.

This change uses the gateway's `Forwarded` header to detect if the
request has already transited through this gateway. This is
determination is made by comparing ID strings, so this will prevent
gateway daisy-chaining when clusters do not use distinct identity
domains.

This ensures that error metrics are recorded and that logging is emitted
uniformly. This also ensures that gRPC requests don't get HTTP error
responses.

This change uses the gateway's `Forwarded` header to detect if the
request has already transited through this gateway. This is
determination is made by comparing ID strings, so this will prevent
gateway daisy-chaining when clusters do not use distinct identity
domains.