https://github.com/linkerd/linkerd2/pull/14149 fixed https://github.com/linkerd/linkerd2/issues/13922 in the case where no ServiceProfile was defined for the target service.
However, when a ServiceProfile is defined for a service, Linkerd will use the `GetProfile` API instead of the client policy API and requests will be allowed to ports not defined in the service.
Unfortunately, the `GetProfile` API does not have a mechanism to signal that connections should be denied. Therefore, when we encounter a `GetProfile` request for a port which is not defined on the service, we return an empty `DestinationProfile`. This causes the proxy to fall back to the client policy API which correctly returns a Forbidden filter and causes the connection to be denied.
We also add an integration test for both the ServiceProfile and non-ServiceProfile cases.
Signed-off-by: Alex Leong <alex@buoyant.io>