[emmanuelgautier]

Closes #13.

Adds protocol.h2_authority_trust, an aggressive-suite check (runs only with --aggressive) covering the HTTP/2 pseudo-header → Host conversion concern: whether the proxy trusts a client-supplied :authority it never validated. Over a forced HTTP/2 connection (ALPN h2, via the stable x/net/http2 client) it sends a distinctive non-routable marker as :authority and flags a finding only when the proxy reflects it while a clean control does not — the HTTP/2 analogue of Host-header injection. Skips against HTTP/1.1-only targets.

Promotes golang.org/x/net to a direct dependency (already present transitively).

Checklist coverage

• :authority pseudo-header to Host/URI conversion / trust inconsistencies
• Stream multiplexing / rapid-reset abuse (CVE-2023-44487) — intentionally deferred (exercising it is the DoS attack)
• QUIC / HTTP/3 malformed frame handling — deferred (no stable Go HTTP/3 stack; fuzzing is intrusive)
• Protocol downgrade as a smuggling precondition — deferred; needs raw HTTP/2 framing, tracked with the smuggling work (Request Smuggling / Desync #10)

Deferred items are documented in docs/checks/protocol.mdx. Includes registration and a category test (HTTP/2 reflecting vs. non-reflecting vs. HTTP/1.1-only stand-ins).