This Implements HTTP/1.1 upgrade tunneling in both proxy server and proxy client so standard WS clients can reach standard WS servers through the proxy.

It add a new --http-mode {http1,http2} flag for the client subcommand (default: http2). This means ws support is opt-in
and the default is http2 support with no ws upgrades.

Server continues to support both h2 and http/1.1; client selects based on flag.

Key changes

• src/lib.rs: upgrade handling via hyper::upgrade::on, bidirectional stream tunnel, with_upgrades() for server/client HTTP/1.1, and new ProxyClientHttpMode.
• src/http_version.rs: simplify HttpConnection to a boxed future to allow upgradeable HTTP/1 connection.
• src/main.rs: new --http-mode flag for client.
• src/attested_get.rs, src/file_server.rs: pass client mode in helpers/tests.
• Cargo.toml/Cargo.lock: add hyper-tungstenite dependency.
• In the proxy-client shared upstream request loop (src/lib.rs), successful responses now set:
  • should_reconnect = resp.status() == 101
• When should_reconnect is true, the loop intentionally breaks and reconnects, creating a fresh upstream attested connection for subsequent traffic.
• Log message updated to clarify this is an intentional upstream rotation after upgrade.

Closes #86