feat: HTTP/1.1 authentication before SSH tunnel

[coolaj86]

Summary

• Add --http-auth <url> flag to authenticate via HTTP/1.1 over TLS before establishing the SSH tunnel
• Add --auth-token <token> flag to send a Bearer token in the Authorization header
• Token can also be embedded in the auth URL as token=xxx (e.g., proxy.example.com/auth?token=mysecret)

How it works

1. When --http-auth is set, each connection first establishes a TLS connection with http/1.1 ALPN
2. An HTTP GET request is sent to the auth URL with a Bearer token (if provided)
3. If authentication succeeds (HTTP 2xx), that connection is closed
4. A second TLS connection is then established with ssh ALPN for the actual SSH tunnel

Usage examples

# Token via separate flag
sclient --http-auth proxy.example.com/auth --auth-token mysecret example.com:22 localhost:2222

# Token embedded in URL
sclient --http-auth proxy.example.com/auth?token=mysecret example.com:22 localhost:2222

# With custom ALPN protocols for the SSH connection
sclient --http-auth proxy.example.com/auth --auth-token mysecret --alpn ssh example.com:22 localhost:2222

Files changed

• sclient.go - Added HttpAuthURL, AuthToken fields to Tunnel struct; added httpAuth() method; updated handleConnection() and test connection logic
• cmd/sclient/main.go - Added --http-auth and --auth-token CLI flags