feat(webconnectivity@v0.5): get a webpage whenever possible (#950)

Implements https://github.com/ooni/probe/issues/2276 and supersedes https://github.com/ooni/probe-cli/pull/949.

internal/experiment/webconnectivity/secureflow.go

@@ -39,10 +39,6 @@ type SecureFlow struct {
 	// Logger is the MANDATORY logger to use.
 	Logger model.Logger
 
-	// Sema is the MANDATORY semaphore to allow just a single
-	// connection to perform the HTTP transaction.
-	Sema <-chan any
-
 	// TestKeys is MANDATORY and contains the TestKeys.
 	TestKeys *TestKeys
 
@@ -65,6 +61,10 @@ type SecureFlow struct {
 	// HostHeader is the OPTIONAL host header to use.
 	HostHeader string
 
+	// PrioSelector is the OPTIONAL priority selector to use to determine
+	// whether this flow is allowed to fetch the webpage.
+	PrioSelector *prioritySelector
+
 	// Referer contains the OPTIONAL referer, used for redirects.
 	Referer string
 
@@ -144,11 +144,9 @@ func (t *SecureFlow) Run(parentCtx context.Context, index int64) {
 
 	alpn := tlsConnState.NegotiatedProtocol
 
-	// Only allow N flows to _use_ the connection
-	select {
-	case <-t.Sema:
-	default:
-		ol.Stop(nil)
+	// Determine whether we're allowed to fetch the webpage
+	if t.PrioSelector == nil || !t.PrioSelector.permissionToFetch(t.Address) {
+		ol.Stop("stop after TLS handshake")
 		return
 	}