Add pre-TLS processing hook for PROXY protocol support and expose methods for HTTP2 shutdown

[jaw-sh]

This adds a PreTlsProcess trait and callback mechanism that allows applications to read and process bytes from the raw TCP stream before the TLS handshake begins. Provides a way to self-implement #132 .

This also exposes HTTP2 session terminators. Closes #775.

The HAProxy PROXY protocol spec requires that the header be parsed from the raw TCP stream before any application protocol processing, including TLS. Currently there's no way to do this in Pingora - by the time ServerApp::process_new runs, TLS has already completed.
https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt

This is how nginx and haproxy handle it: TCP accept → parse PROXY header → TLS handshake → HTTP.
https://github.com/nginx/nginx/blob/master/src/http/ngx_http_request.c#L307-L362

Changes

• Add PreTlsProcess trait in pingora-core/src/listeners/mod.rs
• Thread callback through TransportStackBuilder → TransportStack → UninitializedStream
• Call callback in UninitializedStream::handshake() before TLS
• Make Stream::rewind() public so implementations can put back bytes that aren't PROXY protocol

Usage

struct ProxyProtocolHandler;

#[async_trait]
impl PreTlsProcess for ProxyProtocolHandler {
    async fn process(&self, stream: &mut L4Stream) -> Result<()> {
        // Read PROXY header, update socket digest with real client IP
        Ok(())
    }
}

// In setup:
listeners.set_pre_tls_callback(Arc::new(ProxyProtocolHandler));

This code is being used in a beta server deployment with PROXY Protocol v1 and v2 support to handle incoming traffic from other web servers and Tor with success.

[drcaramelsyrup]

This looks like a pretty straightforward optional callback hook to me, will report back if internal review reports any other suggested changes.

[drcaramelsyrup]

@jaw-sh The name of the callback suggests that we might only want to do this if we will actually perform the tls_handshake a few lines below.

If the callback is only invoked when we actually intend on performing a TLS handshake, would that still work with your use case?

[jaw-sh]

Yes, for my purposes. In insecure HTTP, it is possible to intercept the origin's remote IP through standard header parsing such as Cloudflare's cf-connecting-ip.

[drcaramelsyrup]

In that case I think it makes sense to move this callback inside the if let Some(tls) = self.tls block. "Pre-TLS" to the caller might mean that this is only attempted if we are going to invoke the TLS handshake afterwards.