Add HTTP route filter for setting client IP headers

[hawkw]

HTTP proxies are often configured to add headers to requests that
contain the IP address of the client that request originated from, such
as Forwarded or X-Forwarded-For. The Linkerd proxy does not
currently set these headers.

Depending on the use case, users may desire different behavior regarding
these headers. For example, the Forwarded header is standardized, but
some software may only support the X-Forwarded-For header, which
predated it. In other cases, users may wish to set additional
Linkerd-specific client IP headers, or to configure whether an
additional header value is added to the existing set of headers or
overwrites any previously present header value. See
linkerd/linkerd2#4219 (comment)
for details on some of the potential configurations. Linkerd has not
previously implemented support for these headers, since there was not an
appropriate mechanism for configuring this behavior.

The Gateway API's HTTPRoute filters provide such a configuration
mechanism. However, the RequestHeaderModifier filter (which is
specified by the Gateway API), is not suitable for these headers, as it
can currently only be configured with fixed header values, and not
dynamic ones (such as the client's IP). Adding some mechanism to this
filter for setting client IP headers would probably be a bad idea, since
it would result in Linkerd implementing additional non-standard
behaviour that may not be supported by other systems that implement the
Gateway API's RequestHeaderModifier filter. Instead, we should add a
new filter specifically for these headers.

This branch introduces a new HTTP route filter type, ClientIpHeaders,
which sets headers based on a request's client address. This filter can
modify multiple headers (for example, both Forwarded and
X-Forwarded-For), and can be configured to either append a new value
to a header, or replace the previous value.

This branch adds the implementation of the filter type for setting
client IP headers and adds it to the inbound HTTP route policy service.
However, it does not add this filter to the proxy API, so the control
plane cannot currently configure proxies to enable this filter. This
will be addressed separately, along with the user-facing aspects of
actually configuring this filter, once the implementation of the filter
itself has been added to the proxy. Therefore, this is part of the
implementation of linkerd/linkerd2#4219, but it does not close that
issue.