atunnel: ingress CONNECT support

[Keith Mattix II (keithmattix)]

Finishes up the vision from #715 to have atunnel serve CONNECT on the ingress path. This will give us the option to hit actors on other ports besides 80. I haven't wired up atenet router yet because it's nontrivial; we should do that in a second step so we can have a baseline for performance

[Keith Mattix II (keithmattix)]

This was added to try to reduce some flakiness with OnUpdate being written to/read across tests

[Yuan Gao (ygao-g)]

Heads up: --atunnel-connect-listen-address defaults to 0.0.0.0:444, which adds a third instance of #943. It is a declared containerPort that the router dials for CONNECT, so on an IPv6-only cluster nothing is listening on the worker's v6 PodIP — the same failure as 443. :444 binds all address families and still accepts IPv4.

It also collides textually with #978 and #1042: all three edit the same flag var blocks in cmd/ateom-gvisor/main.go and cmd/ateom-microvm/main.go, and the same arg list in workerpool_apply.go.

[Keith Mattix II (keithmattix)]

Yuan Gao (@ygao-g) I'm not sure I understand; if 0.0.0.0:443 binds dualstack by default, then an ipv6 cluster should still work with it right? The main difference is that #943 was on the egress path and required IP6T_SO_ORIGINAL_DST. The status quo should work with ipv6 only clusters

[Yuan Gao (ygao-g)]

You're right, and my heads-up was wrong.

net.Listen("tcp", "0.0.0.0:444") doesn't bind IPv4-only. Go treats an unspecified address as a wildcard on a listen, so favoriteAddrFamily picks AF_INET6 with IPV6_V6ONLY=0 and the socket is [::]:444, accepting both families — the router reaching the worker's v6 PodIP on 444 works as written. Your read of #943 is the right one: there the dual-stack bind is the bug rather than the fix, because the accepted v6 connection has no IPv4 SO_ORIGINAL_DST to recover. CONNECT takes its target from the request authority and never needs that lookup.

One thing still applies: #1042 changes atunnel-listen-address to :443 in the same var block in both main.gos, so whichever lands second gets a conflict. I'll take the rebase on my side.