[paymog]

Http.open and Http.open.how now connect the way fetch does. Before this change, stream.origin called conn.open.all directly. That skipped the proxy choice, so a program behind HTTPS_PROXY could fetch a URL but could not open a stream to it. It also passed "" as the CA, so a stream to a server with a private CA failed where fetch.ca succeeded.

Changes

• origin.route builds the pool key, the request as sent, and the Route (RouteDirect or RouteProxy) for one origin. The pool path (pool.origin.route) and the stream path (stream.route) both use it, so they cannot drift apart. The proxy rules are the same: an HTTP proxy gets an absolute-form target and Proxy-Authorization, and an HTTPS proxy gets CONNECT before TLS.
• stream.one.of calls proxy.select, as pool.one.of does.
• route.open takes the h2 ALPN offer flag. Pools pass True. Streams pass False, because a stream speaks HTTP/1.1 only.
• open.how, open.raw.how, and open.how.enc take ca after cert. StreamHops carries it. A redirect keeps the CA only on the same origin (stream.trust, using pool.next.ca).

Breaking: http 0.35.0.0 → 0.36.0.0. No sibling calls open.how or open.raw.how. Siblings stay on 0.35.0.0 until a re-pin wave.

Verification

• scripts/check.sh http: exit 0. check.bend now sends a forward stream and a CONNECT stream through the local proxy. The proxy checks the absolute-form target, the Host header, and Proxy-Authorization, and it sees the CONNECT authority.
• http/ca-check.sh (native): open.how with the test CA follows a redirect and reads ok. With "", it fails with ErrTls 100.
• http/mtls-check.sh (native): all mTLS stream and fetch checks pass with the new open.how signature.
• scripts/publish.sh --check: [email protected] will publish.

Closes #471
Refs #440