refactor(netx): use netxlite to build TLSDialer (#790)

This diff modifies netx to use netxlite to build the TLSDialer.

Building the TLSDialer entails building a TLSHandshaker.

While there, hide netxlite names we don't want to be public
and change netx tests to test for functionality.

To this end, refactor filtering to provide an easier to
use TLS server. We don't need the complexity of proxying
rather we need to provoke specific errors.

Part of https://github.com/ooni/probe/issues/2121

internal/netxlite/tls.go

@@ -60,6 +60,15 @@ var (
 	}
 )
 
+// ClonedTLSConfigOrNewEmptyConfig returns a clone of the provided config,
+// if not nil, or a fresh and completely empty *tls.Config.
+func ClonedTLSConfigOrNewEmptyConfig(config *tls.Config) *tls.Config {
+	if config != nil {
+		return config.Clone()
+	}
+	return &tls.Config{}
+}
+
 // TLSVersionString returns a TLS version string. If value is zero, we
 // return the empty string. If the value is unknown, we return
 // `TLS_VERSION_UNKNOWN_ddd` where `ddd` is the numeric value passed