Add opt-in web-H3 session resumption with maintained QUIC fork

[cppla]

Scope

Adopt the reviewed, published AutoCAR-maintained QUIC compatibility fork while keeping native transport on official QUIC. The default chrome-2026-10 full-handshake profile stays unchanged.

Changes

• Add explicit chrome-2026-10-resume for opt-in TLS 1.3 ticket resumption on web H3.
• Each configured H3 client has its own bounded, memory-only native ticket cache. Nil/disabled policy retains full handshakes; H2, standard-library caches and other clients are not shared.
• Every physical reconnection performs fresh proxy authentication; old connection-scoped TCP/UDP credentials cannot authorize the new connection.
• Keep all profiles free of 0-RTT. Add real UDP header/cold/warm TLS gate tests, ticket-confirmed reconnects, cancellation/join, healthy sibling continuation and cache policy regression coverage.
• Pin the maintained QUIC and uTLS sources under their original module identities; reject local, scoped, floating or duplicate replacements. Extend independent original-source advisory queries, attribution and maintenance documentation.

Verification

Exact Go 1.27.2: make check, full make race, module/checksum verification, dependency-boundary offline regressions and source vulnerability scan, plus separate original-uTLS and official-QUIC advisory queries.
The small Linux/ARM64 functional suite runs as the same cross-compiled test binary both in isolated local Docker and on the authorized ARM Linux host. It covers cold/resumed TLS, TCP and CONNECT-UDP reauthentication, cancellation, cache isolation and observable absence of 0-RTT.

The source scan reports no imported/reachable vulnerability. The module-only GO-2026-5932 OpenPGP advisory is not imported by the checked graph; this is not a claim that every dependency is vulnerability-free.

Limits

This is bounded functional and packet-header validation, not a real-browser traffic equivalence study. No large PCAP corpus was resumed, no service was deployed or replaced, and no release tag was created.

Merge only after the exact reviewed head's checks pass; verify the merged tree and its CI separately.

Final dependency and Linux validation

• QUIC: Add opt-in Chrome QUIC session resumption and maintained fork gates quic-go#1, merged commit c1cae948af15a90ec8c3929fb336b9bcd7165bc7, with 22 successful reviewed-head checks and all 11 exact post-merge checks successful. The merged tree matches the reviewed tree.
• uTLS: fix: close custom QUIC handshakes paused for session resumption utls#3, merged commit 14c2a4cb1403d9ad48120936a1fb4e8efe825ad4, with pre/post-merge CI successful.
• Final Go 1.27.2 make check, full make race, checksum and source-scan gates passed using the published remote replacements, without development modfiles.
• The final Linux ARM64 test binary SHA-256 is 54b33af029c117436cfcbbe67b0dc17297b32b6af93fb86ef107237fb23a54a5. Both isolated Docker and ARM Linux passed all eight selected top-level groups; cold and resumed runs observed zero 0-RTT packets. This is loopback integration on those hosts, not a WAN benchmark.
• The remote temporary binaries were removed after verification; no service was deployed or replaced.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.