feat(outbound): add load balancing and circuit breaking proto surface

[unleashed]

Add the protobuf API surface for 429-aware load balancing and circuit breaking
in the outbound proxy stack. This is the first of a series of PRs across
linkerd2-proxy-api, linkerd2-proxy, and linkerd2 that introduce opt-in load
balancing features to the P2C balancer.

Most changes are additive and every new feature requires explicit opt-in via
annotations. Default proxy behavior is unchanged.

Main changes:

• FailureAccrual restructure. Replaces the oneof kind wrapper with a flat
  message to support multiple accrual policies simultaneously. A new SuccessRate
  policy is added alongside the existing ConsecutiveFailures. The shared
  ExponentialBackoff remains inside ConsecutiveFailures for wire compatibility.
  Set max_failures = 0 to disable the consecutive-failure policy while
  retaining the shared backoff.

• LoadBiasConfig. Configures 429-aware load biasing (enabled flag, penalty
  duration, penalty decay) on Http1, Http2, and Grpc protocol messages.

• RetryAfterConfig. Configures handling of Retry-After headers (HTTP
  429/503) and grpc-retry-pushback-ms trailers (gRPC RESOURCE_EXHAUSTED),
  with a configurable max duration cap.

• EjectionConfig. Pool-level ejection protection that prevents circuit
  breakers from ejecting all endpoints in a load-balancing pool by enforcing
  a minimum number of ready endpoints.

Backwards compatibility

We make new proto fields use fresh field numbers (no renumbering), and all
new fields are optional (old consumers just ignore them). For the message
we modify, we make sure it is still backwards compatible (see below).

Wire compatibility (FailureAccrual)

The oneof removal is wire-safe: protobuf encodes oneof fields identically to
regular fields on the wire. The consecutive_failures field retains tag 1 with
wire type 2 (LEN). You can easily verify this yourself:

git checkout origin/main -- proto/outbound.proto
protoc --descriptor_set_out=old.desc -I proto proto/outbound.proto
git checkout origin/amr/proto-load-balancing -- proto/outbound.proto
protoc --descriptor_set_out=new.desc -I proto proto/outbound.proto
protoc --decode_raw < old.desc > old.decoded
protoc --decode_raw < new.desc > new.decoded
diff old.decoded new.decoded

Backoff placement

The ExponentialBackoff backoff field lives inside ConsecutiveFailures
rather than on FailureAccrual directly. This preserves the original field
layout for wire compatibility (backoff was always at tag 2 inside
ConsecutiveFailures). The backoff is shared across all accrual policies:
to use only the success-rate policy, we set consecutive_failures with
max_failures = 0 to disable the consecutive-failure check while still
setting the shared backoff configuration.

Cross-Repo Dependencies

• linkerd2-proxy will consume the new proto types for client policy parsing, circuit breaking, load biasing, and ejection coordination (to-be-pushed). These will refer to either a git commit id in this repo with this PR or to a crate version after this lands.
• linkerd2 control plane will consume this to populate the new fields based on annotations.

[cratelyn]

i've left two comments here, about the same general concern: i think we should avoid the potential for compatibility issues and instead deprecate the existing kind field, without removing it.

in the long run we should find a way to version the protocol, but in the short term we can rely on some small compatibility shims to inspect a FailureAccrual object and determine the proper course of action.

i imagine we can consider both fields existing an error, and perhaps have new control planes log a deprecation warning when an outbound proxy emits the old kind field.

[cratelyn]

✔️ this looks good to me, thanks for talking through this change!