[c4milo]

Why

Port of the fix for stmcginnis#567. With ClientConfig.HTTPClient nil, Connect built a transport that shared http.DefaultTransport's tls.Config pointer, then set InsecureSkipVerify on it when Insecure was true. net/http gives the default transport a non-nil config on its first HTTPS request, so after that, an Insecure connect turned off certificate checks for every later http.Get or http.DefaultClient call in the program. Parallel Connects also wrote the shared config at the same time, which go test -race reports.

Changes

• Clone the default transport's tls.Config instead of sharing it. This ports upstream stmcginnis/gofish#568.
• Set ForceAttemptHTTP2 on the built transport and in the modify path. This ports upstream stmcginnis/gofish#518. net/http turns HTTP/2 off on a transport with its own TLSClientConfig or DialContext. Without the clone, this change would also make net/http write NextProtos into the shared config, so the two land together.
• Tests: the default transport's config is unchanged after an Insecure connect, and http.DefaultClient still rejects a self-signed cert. Parallel Insecure connects pass -race. The client negotiates HTTP/2 with a server that offers it. Each test fails on main.

Both are hand ports into the fork's client.go. Nothing was cherry-picked from upstream.

Compatibility

No API change. Transports that gofish builds, and caller transports it modifies (NoModifyTransport false), now negotiate HTTP/2 when the server offers it. Callers that pass their own client with NoModifyTransport: true see no change. A program that needs HTTP/1.1 against a server with a broken HTTP/2 stack can set GODEBUG=http2client=0.