Re-evaluate TLS (and possibly HTTP) settings and defaults used in the codebase

[mtrmac]

Outstanding comments from containers/image#160:

• Why are we using a ServerDefault tls.Config in a client?
• Why are we applying it only to a single path, not when we override tls.Config for our purposes?
• In tlsclientconfig.NewTransport, the proxyDialer setup should happen before we create a http.Transport, so that we don’t need to override tr.Dial in a created object. Irrelevant after Remove go-conections uses in tlsclientconfig image#1748

[rhatdan]

@mtrmac @vrothberg What is the state of this issue. It is two years old, can we close it?

[vrothberg]

I'll leave that up to @mtrmac.

[mtrmac]

Updated the description — the second item was cleaned up.

The third one is a trivial cleanup; the first one would require actual research, it would be nice for it to eventually happen.

[mtrmac]

The third item will go away, so I’m now re-titling this to track making an opinion on TLS and HTTP

• Do we want to deviate from the standard library’s defaults at all?
• If so, how and why? And document that in the code.

[mtrmac]

Note #619 : that allows callers to deviate, but that doesn’t absolve us from needing to care about the default; it should be used very rarely.