Provide deployment model, where sidecar can be injected into existing ingress giving it access to the service mesh (with mTLS, etc.), but without intercepting traffic from/to the Internet.

See #3059.

cc @costinm @nmittler @ZackButcher