Add --http-auth and --auth-token flags to perform HTTP authentication
over TLS (with http/1.1 ALPN) before establishing the SSH tunnel.
Add --http-upgrade flag to use HTTP Upgrade header mechanism, allowing
the proxy to hijack/switch the connection to SSH on the same TLS
connection (similar to WebSocket upgrade but without websockets).
Two modes:
- Without --http-upgrade: Auth connection is closed after auth, then a
second TLS+SSH connection is established (two connections)
- With --http-upgrade <proto>: After auth, if proxy responds with 101
Switching Protocols + Upgrade: <proto>, the same connection is used
for SSH (single connection, protocol switch)
No changes to existing behavior when --http-auth is not used.
