chore: WIP - native sidecar fixes and test run

[alpeb]

Code Fixes

Running services in init containers is rare. The following changes address those rare cases, but most importantly, when Linkerd runs in native sidecar mode it exposes metrics in a port behind an init container, which might be impacted by these issues:

• Destination controller:

  • endpoints_watcher.go:
    • In the destination controller, listeners weren't getting updated on changes in a Server resource with a port in an init container.
    • Servers with ports on init containers with opaque protocols weren't being applied to ports in init containers.
  • k8s.go:
    • Init containers with host ports were not being considered in the HostIPIndex informer index, and thus couldn't be discovered.
  • workload_watcher.go:
    • The opaque-ports annotation wasn't considering ports in init containers.

• Proxy injection (inject.go):

  • Opaque ports annotations overrides weren't having an effect on ports in init containers.
  • LINKERD2_PROXY_INBOUND_PORTS wasn't considering ports exposed by init containers.

• Healtchecks (healthcheck.go): The check "opaque ports are properly annotated" wasn't considering opaque ports in init containers.

• CLI (policy.go): The linkerd authz command wasn't considering policies applied to ports in init containers.

Tests changes

• Set proxy.nativeSidecar: true, for all tests to run in that mode without further changes
• Update golden files accordingly
• Fix curl.rs in the policy tests so it doesn't block on waiting for the proxy container to terminate
• Fix integration tests dealing with injection

Note that k8s started supporting native sidecars without additional feature flags in v1.28. For this reason the following tests aren't supposed to pass:

• test-policy with k8s v1.23
• test-multicluster with k8s v.1.23
• CNI integration test with k8s v1.27