Add WebSocket tunnel transport

[lipeiying032]

Summary

Adds an optional WebSocket tunnel transport to the Caddy forward proxy. This supports Naive clients behind HTTP/CDN paths that cannot forward HTTP CONNECT.

Implementation

• Adds a websocket subdirective to forward_proxy.
• Reuses the existing forward proxy authentication, ACL, allowed ports, dial timeout, and upstream configuration.
• Reuses the existing Naive Variant 1 padding implementation and negotiation headers.
• Disables WebSocket compression for this path so padding remains visible.
• Keeps WebSocket-specific code in websocket.go instead of expanding the main handler.

Wire protocol

After the WebSocket upgrade, the client sends one binary message:

version(1) | address_type(1) | address | port(2, big endian)

Address types are 1 for IPv4, 3 for a length-prefixed domain, and 4 for IPv6. The server replies with one binary status byte, then subsequent binary messages carry the target TCP stream in both directions.

Authentication uses the existing Proxy-Authorization header.

Testing

• go test -count=1 -timeout=180s ./...
• gofmt on changed Go files
• Added target-header parsing and an authenticated end-to-end test covering:
  • missing credentials returning 407
  • Variant 1 padding negotiation
  • no WebSocket compression
  • a 64 KiB first server-to-client transfer

[klzgrad]

klzgrad/naiveproxy#835