refactor(netx): use netxlite to build TLSDialer (#790)

This diff modifies netx to use netxlite to build the TLSDialer.

Building the TLSDialer entails building a TLSHandshaker.

While there, hide netxlite names we don't want to be public
and change netx tests to test for functionality.

To this end, refactor filtering to provide an easier to
use TLS server. We don't need the complexity of proxying
rather we need to provoke specific errors.

Part of https://github.com/ooni/probe/issues/2121

internal/netxlite/tls_test.go

@@ -591,3 +591,30 @@ func TestNewNullTLSDialer(t *testing.T) {
 	}
 	dialer.CloseIdleConnections() // does not crash
 }
+
+func TestClonedTLSConfigOrNewEmptyConfig(t *testing.T) {
+	t.Run("with nil config", func(t *testing.T) {
+		var input *tls.Config
+		output := ClonedTLSConfigOrNewEmptyConfig(input)
+		if output == nil {
+			t.Fatal("expected non-nil result")
+		}
+		v := reflect.ValueOf(*output)
+		if !v.IsZero() {
+			t.Fatal("expected zero config")
+		}
+	})
+
+	t.Run("", func(t *testing.T) {
+		input := &tls.Config{
+			ServerName: "dns.google",
+		}
+		output := ClonedTLSConfigOrNewEmptyConfig(input)
+		if output == input {
+			t.Fatal("expected two distinct objects")
+		}
+		if !reflect.DeepEqual(input, output) {
+			t.Fatal("apparently the two objects have different values")
+		}
+	})
+}