dns: add ForceAttemptHTTP2

[jsha]

Per https://pkg.go.dev/net/http#hdr-HTTP_2:

The http package's Transport and Server both automatically enable HTTP/2 support for simple configurations.

and https://pkg.go.dev/net/http#Transport:

// If non-nil, HTTP/2 support may not be enabled by default.
TLSClientConfig *tls.Config

Since we were setting a non-default TLSClientConfig to trust custom roots, we accidentally turned off HTTP/2 support. And Unbound requires HTTP/2 to serve DoH queries.

Also, clone the TLS config just to be safe against possible mutation in other packages.

[pgporada]

The default http.Transport used by a default http.Client sets ForceAttemptHTTP2: true. I don't believe we accidentally turned off http/2, I think that the field of rakes that determine when http/2 is disabled is at fault and we happened to inadvertently walk into said field. ForceAttemptHTTP2 itself seems poorly worded given that the doc states "Transport and Server both automatically enable HTTP/2 support..." which is great, why would you need to force it and dig into this boolean?

[jsha]

@pgporada We did accidentally turn off http/2, because we created a new Transport from scratch, so we did not inherit the ForceAttemptHTTP2: true setting from the default transport. Probably it would have been better to do http.DefaultTransport.Clone() and modify from there as desired. I'll send a followup PR.

[aarongable]

(I think Phil was saying that it wasn't our mistake, not that it didn't happen.)