Add pre-TLS processing hook for PROXY protocol support and expose methods for HTTP2 shutdown

[jaw-sh]

This adds a PreTlsProcess trait and callback mechanism that allows applications to read and process bytes from the raw TCP stream before the TLS handshake begins. Provides a way to self-implement #132 .

This also exposes HTTP2 session terminators. Closes #775.

The HAProxy PROXY protocol spec requires that the header be parsed from the raw TCP stream before any application protocol processing, including TLS. Currently there's no way to do this in Pingora - by the time ServerApp::process_new runs, TLS has already completed.
https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt

This is how nginx and haproxy handle it: TCP accept → parse PROXY header → TLS handshake → HTTP.
https://github.com/nginx/nginx/blob/master/src/http/ngx_http_request.c#L307-L362

Changes

• Add PreTlsProcess trait in pingora-core/src/listeners/mod.rs
• Thread callback through TransportStackBuilder → TransportStack → UninitializedStream
• Call callback in UninitializedStream::handshake() before TLS
• Make Stream::rewind() public so implementations can put back bytes that aren't PROXY protocol

Usage

struct ProxyProtocolHandler;

#[async_trait]
impl PreTlsProcess for ProxyProtocolHandler {
    async fn process(&self, stream: &mut L4Stream) -> Result<()> {
        // Read PROXY header, update socket digest with real client IP
        Ok(())
    }
}

// In setup:
listeners.set_pre_tls_callback(Arc::new(ProxyProtocolHandler));

This code is being used in a beta server deployment with PROXY Protocol v1 and v2 support to handle incoming traffic from other web servers and Tor with success.