tunnel: http/2 support

[calebdoxsey]

Currently the Pomerium CLI only supports tunneling TCP connections over HTTP/1 via the CONNECT protocol. There's a variant of the CONNECT protocol described in RFC8441 (Extended CONNECT). We should add support for this.

We will need to detect if the server supports HTTP/2 and that the SETTINGS_ENABLE_CONNECT_PROTOCOL is set. This will likely mean using the x/net/http2 package instead of the http package. If the server does not support Extended CONNECT we should fallback to the existing HTTP/1 solution.

[calebdoxsey]

HTTP/2 support for TCP tunneling is implemented, but not via Extended Connect, rather standard Connect was used (and envoy handled it fine). Unfortunately HTTP/2 support for UDP tunneling requires full Extended Connect support, which is (I believe) blocked on golang/go#53208.