Update clusterLocal docs to allow for exceptions when using wide clusterLocal configs (#15828)

* Update clusterLocal docs for exclusions

Signed-off-by: clarkjohnd <clark.john.d@outlook.com>

* Update content/en/docs/ops/configuration/traffic-management/multicluster/index.md

---------

Signed-off-by: clarkjohnd <clark.john.d@outlook.com>
Co-authored-by: Craig Box <craig.box@gmail.com>

content/en/docs/ops/configuration/traffic-management/multicluster/index.md

@@ -61,6 +61,20 @@ serviceSettings:
 
 {{< /tabset >}}
 
+You can also refine service access down by setting a global cluster-local rule and adding explicit exceptions, which can be specific or wildcard. In the following example, all services in the cluster will be kept cluster-local, except any service in the `myns` namespace:
+
+{{< text yaml >}}
+serviceSettings:
+- settings:
+    clusterLocal: true
+  hosts:
+  - "*"
+- settings:
+    clusterLocal: false
+  hosts:
+  - "*.myns.svc.cluster.local"
+{{< /text >}}
+
 ## Partitioning Services {#partitioning-services}
 
 [`DestinationRule.subsets`](/docs/reference/config/networking/destination-rule/#Subset) allows partitioning a service