fix(netxlite): improve TLS auto-configuration (#409)

Auto-configure every relevant TLS field as close as possible to
where it's actually used.

As a side effect, add support for mocking the creation of a TLS
connection, which should possibly be useful for uTLS?

Work that is part of https://github.com/ooni/probe/issues/1505

internal/netxlite/tlsdialer.go

@@ -43,8 +43,6 @@ func (d *TLSDialer) DialTLSContext(ctx context.Context, network, address string)
 // We set the ServerName field if not already set.
 //
 // We set the ALPN if the port is 443 or 853, if not already set.
-//
-// We force using our root CA, unless it's already set.
 func (d *TLSDialer) config(host, port string) *tls.Config {
 	config := d.Config
 	if config == nil {
@@ -62,8 +60,5 @@ func (d *TLSDialer) config(host, port string) *tls.Config {
 			config.NextProtos = []string{"dot"}
 		}
 	}
-	if config.RootCAs == nil {
-		config.RootCAs = NewDefaultCertPool()
-	}
 	return config
 }