…hijack

Closes #668.

With DOCKER_HOST=tcp://socket-proxy:2375 (plain HTTP, no TLS) the regular
HTTP path works but ContainerExecAttach (the hijack path used by run_exec,
ContainerAttach, ContainerLogs --follow) fails with

  tls: first record does not look like a TLS handshake

Root cause: Go's net/http lazily auto-configures HTTP/2 on the first
request and ALLOCATES Transport.TLSClientConfig in place (to seed
NextProtos=[h2 http/1.1] for ALPN). The Docker SDK's hijack dialer reads
baseTransport.TLSClientConfig as its "TLS is required" signal. After the
first plain-HTTP request lands the SDK misreads the auto-installed config
as operator-configured TLS and calls tls.Dial against the plain daemon.

Reproducer (drives ContainerExecAttach against a plain-HTTP TCP listener
that issues 101 Switching Protocols) fails with the exact user error pre-
fix and passes post-fix. The existing client_tcp_upgrade suite only
asserts DaemonHost() strings — it never exercises the hijack dialer.

Fix: set transport.TLSNextProto to a non-nil empty map on the non-TLS
apply paths (applyUnixTransport, applyTCPTransport, applyPlainTransport).
That is the documented stdlib contract for "do not auto-enable HTTP/2",
which prevents the in-place TLSClientConfig mutation. TLS Docker hosts
(https://, tcp+tls://) keep TLSNextProto nil so ALPN h2 still works.

Note: http:// hijack has a separate, pre-existing failure mode (SDK falls
to net.Dial("http", addr) which Go rejects with "unknown network http").
That requires a TCP DialContext on the http:// transport and is filed as
a follow-up enhancement.

Signed-off-by: Sebastian Mendel <[email protected]>

Tightens PR #681 based on the multi-axis review fan-out:

- Add unit test on disableHTTP2AutoConfig itself (transport-level invariant)
  so a future stdlib refactor cannot silently re-introduce the bug while
  the end-to-end SDK test still passes by chance.
- Add TLS-path negative control (TestApplyTLSTransport_DoesNotDisableHTTP2AutoConfig)
  that guards against accidentally extending the suppression to the TLS
  apply path, which would silently disable ALPN h2 negotiation for https://
  and tcp+tls:// hosts.
- Add table test pinning that every non-TLS apply function calls
  disableHTTP2AutoConfig — catches the silent-omit footgun when new
  schemes are added in future.
- Add t.Skip placeholder for http:// hijack so the gap is visible in
  `go test -v` output and reachable via grep from the test directory.
- Apply disableHTTP2AutoConfig to the createHTTPClient unknown-scheme
  fallback (defensive — same hijack risk applies to direct test callers
  with exotic schemes).
- Fix t.Logf race in the fake-proxy serve goroutine by routing through
  http.Server.Shutdown and a done channel so the goroutine exits before
  test cleanup completes.
- Trim disableHTTP2AutoConfig doc comment (drop cost-justification
  paragraph and the upstream-quote nicety; keep the load-bearing WHY
  and the upstream-code reference).
- Add CHANGELOG.md Unreleased > Fixed entry (matches the docker-adapter
  release-notes convention from prior PRs #634 / #627 / #653 / #613).
- Add docs/TROUBLESHOOTING.md entry for v0.25.0 plain-tcp:// run_exec
  failure mode (slots next to the related #605 socket-proxy section);
  cross-reference from the older v0.11.0 HTTP/2 section so operators
  scanning by topic land on the right bug.

Deferred to follow-up issues (out of scope for this PR):
- Refactor to schemeHandler.tlsCapable flag to kill the silent-omit
  footgun structurally.
- Dead ClientConfig.HTTPClient field (pre-existing, unrelated cleanup).

Signed-off-by: Sebastian Mendel <[email protected]>