refactor(netxlite): hide details without breaking the rest of the tree (#454)

## Description

This PR continues the refactoring of `netx` under the following principles:

1. do not break the rest of the tree and do not engage in extensive tree-wide refactoring yet
2. move under `netxlite` clearly related subpackages (e.g., `iox`, `netxmocks`)
3. move into `internal/netxlite/internal` stuff that is clearly private of `netxlite`
4. hide implementation details in `netxlite` pending new factories
5. refactor `tls` code in `netxlite` to clearly separate `crypto/tls` code from `utls` code

After each commit, I run `go test -short -race ./...` locally. Each individual commit explains what it does. I will squash, but this operation will preserve the original commit titles, so this will give further insight on each step.

## Commits

* refactor: rename netxmocks -> netxlite/mocks

Part of https://github.com/ooni/probe/issues/1591

* refactor: rename quicx -> netxlite/quicx

See https://github.com/ooni/probe/issues/1591

* refactor: rename iox -> netxlite/iox

Regenerate sources and make sure the tests pass.

See https://github.com/ooni/probe/issues/1591.

* refactor(iox): move MockableReader to netxlite/mocks

See https://github.com/ooni/probe/issues/1591

* refactor(netxlite): generator is an implementation detail

See https://github.com/ooni/probe/issues/1591

* refactor(netxlite): separate tls and utls code

See https://github.com/ooni/probe/issues/1591

* refactor(netxlite): hide most types but keep old names as legacy

With this change we avoid breaking the rest of the tree, but we start
hiding some implementation details a bit. Factories will follow.

See https://github.com/ooni/probe/issues/1591

internal/netxlite/internal/generator/main.go

@@ -0,0 +1,86 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+//
+// Forked from github.com/certifi/gocertifi <https://git.io/JJjmG>.
+//
+// This script should not be invoked directly, rather it should be
+// executed by running go generate ./... from toplevel dir.
+
+package main
+
+import (
+	"context"
+	"crypto/x509"
+	"log"
+	"net/http"
+	"os"
+	"strings"
+	"text/template"
+	"time"
+
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
+)
+
+var tmpl = template.Must(template.New("").Parse(`// Code generated by go generate; DO NOT EDIT.
+// {{ .Timestamp }}
+// {{ .URL }}
+
+package netxlite
+
+//{{ .GoGenerate }} go run ./internal/generator/ "{{ .URL }}"
+
+const pemcerts string = ` + "`" + `
+{{ .Bundle }}
+` + "`" + `
+`))
+
+func main() {
+	if len(os.Args) != 2 || !strings.HasPrefix(os.Args[1], "https://") {
+		log.Fatal("usage: go run ./generator/ <url>")
+	}
+	url := os.Args[1]
+
+	resp, err := http.Get(url)
+	if err != nil {
+		log.Fatal(err)
+	}
+	if resp.StatusCode != 200 {
+		log.Fatal("expected 200, got", resp.StatusCode)
+	}
+	defer resp.Body.Close()
+
+	bundle, err := iox.ReadAllContext(context.Background(), resp.Body)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	pool := x509.NewCertPool()
+	if !pool.AppendCertsFromPEM(bundle) {
+		log.Fatalf("can't parse certificates from %s", url)
+	}
+
+	fp, err := os.Create("certifi.go")
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	err = tmpl.Execute(fp, struct {
+		Bundle     string
+		GoGenerate string
+		Timestamp  time.Time
+		URL        string
+	}{
+		Bundle:     string(bundle),
+		GoGenerate: "go:generate",
+		Timestamp:  time.Now(),
+		URL:        url,
+	})
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	if err := fp.Close(); err != nil {
+		log.Fatal(err)
+	}
+}