When a user application accepts or initiates a connection, it should be able to somehow access metadata from ztunnel about the connection. At minimum, this would be the identity of the peer.

This can be used in applications to do app-specific logic based on identity, or even in a "sandwhich" case where we run ztunnel alongside Envoy