feat(kuma-cp) Support probes with mTLS enabled

[lobkovilya]

Summary

Current PR fixes the known issue of Kuma - the ability to add Kubernetes probes with mTLS enabled.
Given HttpGet probe :8080/health will be automatically converted to virtual probe :9000/8080/health, where 9000 is an insecure port regardless of the state of mTLS. Traffic from this port is always forwarded by Envoy to localhos:8080/health.

Changes in kuma-cp config

injector section has new fields:

injector:
  ...
  virtualProbesEnabled: true
  virtualProbesPort: 9000

They allows us to set another value for insecure port or disable virtual probes at all.

New Pod annotations

Both values from previous section could be override by Pod's annotations:

// KumaVirtualProbesPortAnnotation is an insecure port for listening virtual probes
KumaVirtualProbesPortAnnotation = "kuma.io/virtual-probes-port"

// KumaMetricsPrometheusPort allows to override `Mesh`-wide default port
KumaMetricsPrometheusPort = "prometheus.metrics.kuma.io/port"

Annotation refactoring

We used to check annotation values only against "good" values, some "junk" was allowed, like:

kuma.io/ingress: some-junk

was considered as not "enabled". Current PR makes annotation more strict

Issues resolved

Fix #795

Documentation

• Link to the website documentation PR

[jakubdyszkiewicz]

really nice job here 👍 can we have this tested in E2E test somehow? Can we add HTTP probe to some existing app?

[jakubdyszkiewicz]

could be more descriptive why it cannot be parsed