Fix TLS to targets through HTTPS proxies (#1183)

Reset the target-facing TLS state after a CONNECT response so HTTPS requests through HTTPS proxies establish a second TLS layer to the target. Extend the in-memory test transport to exercise CONNECT and add an end-to-end nested TLS regression test.