It is sometimes useful to control an HTTP server with a
Context (e.g. when using an errgroup). NOTE that this function does
not install a SIGTERM handler.

The ProxyHandler apparently assumes that you're running a gorilla.Mux
for request routing, as it sets the URL.Scheme field of the incoming
request - which is normally unset. This has the consequence of messing
up all sorts of things, including redirects, because the other
fields (like Host) of the request URL are still going to be unset.

We've been actually assuming ACLs were working this way in all our
configuration files, so better make it so: the first path match in the
ACL allow list will cause the list iteration to stop (the final result
will then depend on the CN match).

The clients already support it (via the default net/http.Transport),
and it can be enabled with a configuration parameter. The default is
still currently disabled, though there is plan to flip it later to
enabled-by-default if it proves to be working as expected in
production.

We also introduce, via a slight refactoring of the Serve() code, a
test of the top-level http.Handler (with the full middleware stack).

Use mime.ParseMediaType to obtain the main content type.

It was acting as an upper limit for the request lifetime, which isn't
necessary on internal services.

This is a high-level timeout for the http.Handler application code,
not a low-level network timeout.

Trace requests on client and server HTTP traffic, using a system-wide
configuration file to control reporting.

And return the right error code (403, not 401).

Doh, don't know how this was missed until now.

Fixes include:
* only notify systemd after the network socket has been opened
* add net/http/pprof debug handlers
* add /health endpoint for Prometheus blackbox prober

Allows users to specify a set of trusted forwarders in the
configuration, and then using github.com/gorilla/handlers.ProxyHeaders
to rewrite the http.Request parameters according to X-Forwarding-* and
X-Real-IP headers.

Reduces cyclomatic complexity score and makes code more readable.

Includes TLS authentication, to authorize peers
based on the subject of their X509 certificate.