node: cover h2c upgrade route and TLS protocol negotiation

[lupin012]

StartHTTPEndpoint is the single entry point for every JSON-RPC listener
(http, https, separate ws, engine) and negotiates four protocol routes.
Only one of them had a test. This PR adds the missing coverage; no
production code changes.

h2c upgrade route

TestHTTP2H2CUpgrade pins the HTTP/1.1 Upgrade route into h2c (RFC 7540
Section 3.2) — the one curl --http2 uses over cleartext, as opposed to
--http2-prior-knowledge.

Worth pinning because the two h2c routes are not interchangeable. The
x/net/http2/h2c wrapper we use serves both, while the stdlib
http.Protocols route (SetUnencryptedHTTP2) only recognizes the
prior-knowledge preface and has no handling for Upgrade: h2c. Replacing
the wrapper with the stdlib API — as geth did in ethereum/go-ethereum#33812,
which is the upstream equivalent of our #19100 — would silently downgrade
these clients to HTTP/1.1. The test now catches that.

TLS endpoint

TestHTTPSEndpoint covers the ServeTLS path behind --https.enabled,
which had no test at all: HTTP/2 negotiated via ALPN, plus the HTTP/1.1
fallback on the same listener. The certificate is generated in-process, so
no fixture lands on disk and no git restore-mtime entry is needed.

Short-mode guard

Dropped the testing.Short() guard on TestHTTP2H2C: it is labelled
"slow test" but runs in well under a second, so it only hid the test from
the -short suite.

Testing

• All three tests pass, -count=3 with no flakes.
• Verified the new tests actually have teeth rather than passing
  vacuously: applying geth's exact protocol config (SetHTTP1 +
  SetUnencryptedHTTP2) to StartHTTPEndpoint makes TestHTTPSEndpoint
  fail, and dropping the h2c wrapper makes TestHTTP2H2CUpgrade fail.
• go test ./node/... -short green, make lint clean.

Test-only change, so the Red → Green cycle does not apply: these pin
existing behavior that was untested.

[Copilot]

Pull request overview

Adds missing test coverage around JSON-RPC listener protocol negotiation in StartHTTPEndpoint (the shared entry point for HTTP, HTTPS, WS, engine), without changing production behavior. This helps prevent regressions in HTTP/2 cleartext (h2c) upgrade handling and TLS ALPN negotiation.

Changes:

• Remove the testing.Short() skip from the existing h2c (prior-knowledge) test so it runs in -short.
• Add TestHTTP2H2CUpgrade to pin the HTTP/1.1 Upgrade: h2c route (curl --http2 cleartext behavior).
• Add TestHTTPSEndpoint plus an in-test self-signed cert helper to cover ServeTLS, including HTTP/2 via ALPN and HTTP/1.1 fallback.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[yperbasis]

Verified locally: -count=5 and -race green; replicating the geth-style protocol config (ethereum/go-ethereum#33812) makes both new tests fail as intended.

Two non-blocking nits:

• In newSelfSignedCert, IsCA: true is silently dropped from the encoded cert because BasicConstraintsValid is not set, and KeyUsageCertSign is unused for a leaf served under InsecureSkipVerify. Either drop both, or go further and pin the cert via RootCAs — the 127.0.0.1 IP SAN is already there, and it would remove the //nolint:gosec. Pinning would also require BasicConstraintsValid: true.
• TestHTTPSEndpoint sets no client timeout, so a server hang would only surface at the go-test deadline. Same shape as the existing TestHTTP2H2C, so fine to leave as is.

[lupin012]

@yperbasis Updated sw to solve non blocking issue