proxy: http2 proxy tunnel implementation

- currently only on debug build and when env variable
  CURL_PROXY_TUNNEL_H2 is present.
- will ALPN negotiate with the proxy server and switch
  tunnel filter based on the protocol negotiated.
- http/1.1 tunnel code moved into cf-h1-proxy.[ch]
- http/2 tunnel code implemented in cf-h2-proxy.[ch]
- tunnel start and ALPN set remains in http_proxy.c
- moving all haproxy related code into cf-haproxy.[ch]

VTLS changes
- SSL filters rely solely on the "alpn" specification they
  are created with and no longer check conn->bits.tls_enable_alpn.
- checks on which ALPN specification to use (or none at all) are
  done in vtls.c when creating the filter.

Testing
- added a nghttpx forward proxy to the pytest setup that
  speaks HTTP/2 and forwards all requests to the Apache httpd
  forward proxy server.
- extending test coverage in test_10 cases
- adding proxy tests for direct/tunnel h1/h2 use of basic auth.
- adding test for http/1.1 and h2 proxy tunneling to pytest

Closes #10780

tests/http/test_01_basic.py

@@ -46,37 +46,34 @@ class TestBasic:
         curl = CurlClient(env=env)
         url = f'http://{env.domain1}:{env.http_port}/data.json'
         r = curl.http_get(url=url)
-        r.check_exit_code(0)  
-        assert r.response['status'] == 200
+        r.check_response(http_status=200)
         assert r.json['server'] == env.domain1
 
     # simple https: GET, any http version
+    @pytest.mark.skipif(condition=not Env.have_ssl_curl(), reason=f"curl without SSL")
     def test_01_02_https_get(self, env: Env, httpd):
         curl = CurlClient(env=env)
         url = f'https://{env.domain1}:{env.https_port}/data.json'
         r = curl.http_get(url=url)
-        r.check_exit_code(0)  
-        assert r.response['status'] == 200
+        r.check_response(http_status=200)
         assert r.json['server'] == env.domain1
 
     # simple https: GET, h2 wanted and got
+    @pytest.mark.skipif(condition=not Env.have_ssl_curl(), reason=f"curl without SSL")
     def test_01_03_h2_get(self, env: Env, httpd):
         curl = CurlClient(env=env)
         url = f'https://{env.domain1}:{env.https_port}/data.json'
         r = curl.http_get(url=url, extra_args=['--http2'])
-        r.check_exit_code(0)  
-        assert r.response['status'] == 200
-        assert r.response['protocol'] == 'HTTP/2'
+        r.check_response(http_status=200, protocol='HTTP/2')
         assert r.json['server'] == env.domain1
 
     # simple https: GET, h2 unsupported, fallback to h1
+    @pytest.mark.skipif(condition=not Env.have_ssl_curl(), reason=f"curl without SSL")
     def test_01_04_h2_unsupported(self, env: Env, httpd):
         curl = CurlClient(env=env)
         url = f'https://{env.domain2}:{env.https_port}/data.json'
         r = curl.http_get(url=url, extra_args=['--http2'])
-        r.check_exit_code(0)  
-        assert r.response['status'] == 200
-        assert r.response['protocol'] == 'HTTP/1.1'
+        r.check_response(http_status=200, protocol='HTTP/1.1')
         assert r.json['server'] == env.domain2
 
     # simple h3: GET, want h3 and get it
@@ -85,7 +82,5 @@ class TestBasic:
         curl = CurlClient(env=env)
         url = f'https://{env.domain1}:{env.h3_port}/data.json'
         r = curl.http_get(url=url, extra_args=['--http3'])
-        r.check_exit_code(0)  
-        assert r.response['status'] == 200
-        assert r.response['protocol'] == 'HTTP/3'
+        r.check_response(http_status=200, protocol='HTTP/3')
         assert r.json['server'] == env.domain1