Consider impact of proxy-initiated close on HTTP 407

[bemasc]

@ekinnear noted today that the performance impact of proxies closing the connection after returning HTTP 407 are not merely hypothetical, and are significant in practice. This draft currently says that proxies MAY adopt this behavior as a mitigation for potential misbehaving clients.

Some things we could do:

• Remove this MAY. After a closer look at some earlier anecdotes, we have not actually found a client that exhibits the misbehavior.
• Conduct some kind of study or outreach to see if we can find any misbehaving clients (i.e. CONNECT clients that send first-flight payload data without waiting for the 200 response).
• Define a request header like "Vulnerable-To-Request-Smuggling: ?0", by which the client promises that it is proxying TCP connections for a trusted TCP client or delaying payload data until after the success response, so there is no need for defensive measures.