For traffic to unknown addresses, or to workloads that are not a part of the mesh, the traffic will just be passed through as is.
To make ztunnel more transparent, the original source IP address will be spoofed.
Additionally, `splice` will be used to make this proxying more efficient when possible.

For traffic in the mesh, things are a bit more complex:

1. If the destination has a waypoint proxy, we must send to it to the waypoint (using HBONE).

	if err != nil {
		s.writeErrorResponse(w, err)
		return
	}
	defer rc.Close()

	rf, ok := w.(io.ReaderFrom)
	if ok && runtime.GOOS != "windows" {
		// Attempt to use splice/sendfile() optimization, A very specific behavior mentioned below is necessary.
		// See https://github.com/golang/go/blob/f7c5cbb82087c55aa82081e931e0142783700ce8/src/net/sendfile_linux.go#L20

	"cmd/internal/src"
)

// A Slice reads from a slice of Tokens.
type Slice struct {
	tokens []Token
	base   *src.PosBase
	line   int
	pos    int
}

func NewSlice(base *src.PosBase, line int, tokens []Token) *Slice {
	return &Slice{
		tokens: tokens,
		base:   base,
		line:   line,
		pos:    -1, // Next will advance to zero.
	}
}

func (s *Slice) Next() ScanToken {
	s.pos++

	return genSplit(s, sep, len(sep), n)
}

// Split slices s into all subslices separated by sep and returns a slice of
// the subslices between those separators.
// If sep is empty, Split splits after each UTF-8 sequence.
// It is equivalent to SplitN with a count of -1.
//
// To split around the first instance of a separator, see Cut.
func Split(s, sep []byte) [][]byte { return genSplit(s, sep, 0, -1) }

  public void testSlice_constrainedRange() throws IOException {
    long size = source.read().length;
    if (size >= 2) {
      ByteSource sliced = source.slice(1, size - 2);
      assertEquals(size - 2, sliced.read().length);
      ByteSource resliced = sliced.slice(0, size - 1);
      assertTrue(sliced.contentEquals(resliced));
    }
  }

  private void assertExpectedBytes(byte[] readBytes) {

  public void testSlice_constrainedRange() throws IOException {
    long size = source.read().length;
    if (size >= 2) {
      ByteSource sliced = source.slice(1, size - 2);
      assertEquals(size - 2, sliced.read().length);
      ByteSource resliced = sliced.slice(0, size - 1);
      assertTrue(sliced.contentEquals(resliced));
    }
  }

  private void assertExpectedBytes(byte[] readBytes) {

  optional string addressType = 4;

  // endpoints is a list of unique endpoints in this slice. Each slice may
  // include a maximum of 1000 endpoints.
  // +listType=atomic
  repeated Endpoint endpoints = 2;

  // ports specifies the list of network ports exposed by each endpoint in
  // this slice. Each port must have a unique name. When ports is empty, it

// it has sufficient capacity, the destination is resliced to accommodate the
// new elements. If it does not, a new underlying array will be allocated.
// Append returns the updated slice. It is therefore necessary to store the
// result of append, often in the variable holding the slice itself:
//
//	slice = append(slice, elem1, elem2)
//	slice = append(slice, anotherSlice...)
//

        << entry.InitializationErrorString();
    for (int i = 0; i < entry.slices_size(); ++i) {
      const auto& slice_proto = entry.slices(i);
      CHECK(filtered_keys
                .insert(EncodeTensorNameSlice(
                    string(v2_reader_->key()) /* full var's name */,
                    TensorSlice(slice_proto)))
                .second);
    }
  }

  optional string addressType = 4;

  // endpoints is a list of unique endpoints in this slice. Each slice may
  // include a maximum of 1000 endpoints.
  // +listType=atomic
  repeated Endpoint endpoints = 2;

  // ports specifies the list of network ports exposed by each endpoint in
  // this slice. Each port must have a unique name. When ports is empty, it