retry: enforce a cap on max replay buffer size

[hawkw]

This branch adds a limit to the maximum number of bytes a ReplayBody
will buffer, as a defense-in-depth against unbounded buffering.
Currently, the retry policy should ensure that requests whose
content-length header is over the limit will not be wrapped with
ReplayBody. However, if there's a bug in the retry policy, or if a
request claims to have an acceptable content-length but keeps sending
data past that length, we might buffer a potentially unbounded amount of
data. This limit is intended to ensure we don't buffer data over the
limit despite the content-length-based retry policy.

The limit is checked whenever new data is added to the buffer, and if it
is reached, the buffer is discarded and the ReplayBody will cease
buffering additional data. However, the body will be allowed to continue
streaming so that the initial request may still complete --- but
attempting to retry it will fail, because the buffer was discarded. This
way, in the event of a request that somehow passes the limit, we won't
fail that request immediately, but instead will fall back to not
retrying it.

In order to make this change nicely, the ReplayBody has to be
constructed by the retry policy, rather than by the Retry service.
This is because the policy knows what the size limits for retries is. To
allow this, I did some refactoring. In particular, I introduced a new
trait for retry policies that's an extension of tower::retry::Policy,
but with the addition of a method that's called to modify the request
for a retry. This method returns an Either, with Either::A
indicating that the request should be retried, and Either::B
indicating that it should not; and in the retry case, the policy may
change the request's type. This allows the retry policy to be
responsible for wrapping the request in a ReplayBody, rather than
doing that in the Retry service. A nice side-effect of this change is
that the linkerd-retry crate no longer needs to be HTTP-specific. All
the HTTP-specific code now lives in linkerd_app_core::retry, with the
exception of the ReplayBody type, which I put in its own crate (mainly
just to allow running its tests without having to compiel all of
app-core).

[olix0r]

Shared some suggestions via #1045

[hawkw]

yay!