Proritize HTTP/1.1 over HTTP/2.

[mdwn]

Due to a bug in Chrome, secure websockets in Teleport work intermittently on the Chrome browser when using HTTP/2. Prioritizing HTTP/1.1 fixes this issue, though the reasons for this are not 100% clear. When or if https://bugs.chromium.org/p/chromium/issues/detail?id=1379017 is resolved, we should be able to revert this. When golang/go#49918 is implemented, we may be able to revert this if enabling HTTP/2 websockets fixes the issue on our end.

Should address #16031.

[r0mant]

@mdwn I think we should test Kubernetes Access and make sure to prefer h2 for it - our ALPN router relies on Kube Access requests having server name prefixed with "kube." so we should be able to utilize GetConfigForClient? cc @tigrato

[mdwn]

@mdwn I think we should test Kubernetes Access and make sure to prefer h2 for it - our ALPN router relies on Kube Access requests having server name prefixed with "kube." so we should be able to utilize GetConfigForClient? cc @tigrato

I'm working on testing/implementing this as we speak.

[mdwn]

@r0mant I don't believe anything is actually necessary here because the kube ALPN protocol uses ForwardTLS, skipping the prioritization configured within ALPN. With this PR as is, doing a kubectl get pods against minikube, I get the following in the kubernetes API server:

I1027 19:37:22.097113       1 trace.go:205] Trace[321091873]: "Get" url:/api/v1/namespaces/teleport-agent/pods/teleport-agent-0/log,user-agent:kubectl/v1.25.0 (darwin/arm64) kubernetes/a866cbe,audit-id:aaca85e9-82c3-4cb0-8b96-4e26f312cff0,client:172.17.0.1,accept:application/json, */*,protocol:HTTP/2.0 (27-Oct-2022 19:37:15.448) (total time: 6648ms):

Doing a raw curl of the kube endpoint gets:

➜  teleport git:(mike.wilson/prioritize-http11-instead-of-http2) ✗ curl -k https://kube.mw-test.teleport -v    
*   Trying 192.168.1.232:443...
* Connected to kube.mw-test.teleport (192.168.1.232) port 443 (#0)
* ALPN: offers h2
* ALPN: offers http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
...
* ALPN: server accepted h2
...
* Using HTTP2, server supports multiplexing
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
...
> GET / HTTP/2

Additionally, doing a curl of the front page of Teleport gets us:

➜  teleport git:(mike.wilson/prioritize-http11-instead-of-http2) ✗ curl -k https://mw-test.teleport -v 
*   Trying 192.168.1.232:443...
* Connected to mw-test.teleport (192.168.1.232) port 443 (#0)
* ALPN: offers h2
* ALPN: offers http/1.1
...
* ALPN: server accepted http/1.1
...
> GET / HTTP/1.1

@tigrato Does this sound right?

[github-actions]

@mdwn See the table below for backport results.

Branch	Result
branch/v10	Create PR
branch/v11	Create PR
branch/v9	Failed