When curl uses a proxy, it will only use Basic unless we prompt it to
try to use the most secure on it has available.

This is something which git did recently, and it seems like a good idea.

We do not want libcurl to perform the TLS negotiation for us, so we
don't need to pass this option.

The information is exposed by curl for some crypto libraries in the form
of name:content strings. We can't do much more than return this
information.

If the stream claims to support this feature, we can let the transport
set the proxy.

We also set HTTPPROXYTUNNEL option so curl can create a tunnel through
the proxy which lets us create our own TLS session (if needed).

cURL has a mode in which it acts a lot like our streams, providing send
and recv functions and taking care of the TLS and proxy setup for us.

Implement a new stream which uses libcurl instead of raw sockets or the
TLS libraries directly. This version does not support reporting
certificates or proxies yet.