How does the Sidecar pattern work in Kubernetes, for example with Istio or Envoy? How does this pattern allow offloading traffic encryption (mTLS), request tracing, and retries from the application?