deps: bump quic-go to v0.59.0 (unbounded fork rebased)

[myleshorton]

Summary

Bumps `quic-go` from v0.51.0 → v0.59.0. Stacked on top of #351 (pion v4.2) — target branch is `fisk/pion-v4.2` so the diff stays focused; will re-target `main` once #351 merges.

Our fork is still needed

Our fork exists for a single 2-line patch in `internal/protocol/params.go`:

```go
-const MaxActiveConnectionIDs = 4
+const MaxActiveConnectionIDs = 54
-const MaxIssuedConnectionIDs = 6
+const MaxIssuedConnectionIDs = 56
```

This raises the connection-ID budget to support more lifetime migrations per QUIC session (peer churn in unbounded). Upstream still has these as unexported consts in v0.59.0, so there's no way to configure them without patching.

I rebased this single commit onto upstream v0.59.0 in `getlantern/quic-go-unbounded-fork` and tagged the result `v0.59.0-unbounded`. This PR updates the `replace` directive to the new tag.

API breaks between v0.51 and v0.59

quic-go promoted two interfaces to concrete struct pointers:

• `quic.Connection` (interface) → `*quic.Conn` (struct pointer)
• `quic.Stream` (interface) → `*quic.Stream` (struct pointer)

Touched files:

• `clientcore/quic.go` — eventualConn stores `*quic.Conn`
• `egress/quic.go` — connectionManager stores `*quic.Conn`, `transport.Dial` now returns `*quic.Conn` directly (dropped double-pointer `&newConn`)
• `common/network.go` — `QUICStreamNetConn.Stream` field is now `*quic.Stream`
• `common/version.go` — `v2.2.0` → `v2.3.0` (API surface changed)

Test plan

• `go build ./...` passes
• `go test ./...` passes
• lantern-box's `TestUnboundedE2E` passes end-to-end with this branch pinned in (5.59s, full sing-box → consumer → WebRTC → widget → QUIC/WS → egress chain)

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Updates the project’s QUIC dependency to the rebased quic-go-unbounded-fork at v0.59.0-unbounded, and migrates local code to quic-go’s v0.59 API changes (connection/stream types now concrete pointer types). Also bumps the project version to reflect the API surface change.

Changes:

• Bump github.com/quic-go/quic-go to v0.59.0 and update the replace to github.com/getlantern/quic-go-unbounded-fork v0.59.0-unbounded.
• Update QUIC integration code to use *quic.Conn and *quic.Stream instead of the old interface types.
• Bump common.Version from v2.2.0 to v2.3.0.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
go.mod	Updates quic-go requirement and replace directive to the new fork tag.
go.sum	Refreshes module sums for the dependency bump / tidy result.
clientcore/quic.go	Migrates stored/returned QUIC connection type to *quic.Conn.
egress/quic.go	Migrates connection manager storage/return types to *quic.Conn.
common/network.go	Updates QUICStreamNetConn to embed *quic.Stream.
common/version.go	Bumps the project version constant to v2.3.0.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Now that connectionRecord.connection is a *quic.Conn (and lastPath is a *quic.Path), the explicit dereferences (*record.connection).… / (*record.lastPath).… later in this file are redundant remnants from when this was a pointer-to-interface. Consider switching those call sites to record.connection.… and record.lastPath.… to avoid confusion about the actual types (and reduce the chance of someone reintroducing a **T by accident).

[myleshorton]

Closing — the sagernet qpack API cascade (sing-box-minimal's `sagernet/quic-go@v0.52.x` uses `qpack@v0.5.1` while quic-go v0.59.0 needs `qpack@v0.6.0`) blocks this from merging cleanly today.

The four-module upgrade chain and the resurrection plan are tracked in getlantern/engineering#3234. Fork tag `v0.59.0-unbounded` is published so whoever picks this up has the rebased patch ready to consume. The `fisk/quic-go-v0.59` branch stays on the repo as a resurrection point.

For the immediate censorship-resistance motivation (net4people/bbs#603), the covert-dtls PR #350 and the pion bump PR #351 are the landable pieces and cover the threat.