v1.11.0 — drop status_request, and set Proxy-Connection

Two more places where an identity could be described but not presented.

tls.omitExtensions

The subtractive counterpart to extraExtensions, and status_request (5) is what it exists for —
the one extension this package sends that curl does not, so a sample without it could not be matched
at all. Ordering cannot help (orderExtensions arranges what was built), and there was no other
way to unbuild it.

Dropping it gives up OCSP stapling, the only revocation signal this package consumes. With
trust.revocation: 'require-staple' that is not a stricter policy but one that can never be
satisfied — no staple is requested, so none arrives, so every connection fails on a certificate never
asked to carry one. Refused at configuration time rather than at handshake time, where it would look
like a server problem.

proxy.proxyConnection

Replaces a hard-coded Proxy-Connection: keep-alive on the CONNECT request. The header is
pre-standard, clients disagree about it, and while the origin never sees it the proxy always
does — so for anyone matching a client's behaviour at the proxy it is part of the fingerprint.

Default unchanged. null omits the header, which is not the same as sending close.

Both omissions are reproduced on a HelloRetryRequest retry, because a second hello that changed its
extension set would be malformed under RFC 8446 §4.1.2 and a signal in itself.

1260 offline tests pass.