fix: support SOCKS5 UDP associations over MASQUE

[Niek]

Summary

• return a destination-aware PacketConn when MASQUE receives a destinationless UDP association
• lazily open and cache one CONNECT-UDP stream per destination
• isolate destination tunnel failures and bound tunnel creation by the connector timeout
• preserve domain destinations without resolving them inside the MASQUE connector
• send standard HTTP/3 CONNECT without an invalid :protocol pseudo-header

The SOCKS5 handler establishes UDP associations with Router.Dial(ctx, "udp", ""). MASQUE previously passed that empty address to SplitHostPort, so UDP ASSOCIATE failed before the SOCKS5 success reply. Each destination now gets its own CONNECT-UDP stream; a refused or reset destination is dropped and can be re-dialed without terminating the shared association. Clients requiring IP-form SOCKS5 replies can use the existing udp.resolveDomain handler option.

Related to go-gost/gost#793.

Validation

• go test -race ./connector/masque ./dialer/http3/masque ./internal/util/masque
• go vet ./connector/masque ./dialer/http3/masque ./internal/util/masque
• built the GOST CLI with this module for Linux ARM64
• live Stealthium 151 E2E through Bright Data MASQUE with udp.resolveDomain: https://google.com/generate_204 returned 204 over CDP protocol h3
• the same E2E failed all three attempts on the preceding PR commit and passed with these fixes