net/http: backport http2 first byte loss CL to go 1.6.x maybe

[bradfitz]

If we do another Go 1.6.x release, consider adding the fix for #17071

[rsc]

Now that Go 1.7 is out, Go 1.6.x should be for security releases and only security releases. This may be a serious functionality bug, but if so, people should update to Go 1.7.