derp/derphttp: add tests for proxied CONNECT port selection

Adds two tests covering the fix in 0e4c8fc92:

TestDialNodeUsingProxyPort exercises dialNodeUsingProxy directly via a
stub CONNECT proxy, asserting the recorded target across four cases:
HTTPS/HTTP default fallback and explicit DERPPort override for each.

TestConnectThroughProxyHonorsDERPPort drives the full path end-to-end:
a real derpserver on an ephemeral TLS port, a real CONNECT proxy that
tunnels bytes bidirectionally, and a region client routed through it
via feature.HookProxyFromEnvironment. Without the fix, Connect fails
because the proxy is asked to dial :443.

Signed-off-by: Martin Zihlmann <martizih@outlook.com>

derp/derphttp/export_test.go

@@ -3,10 +3,22 @@
 
 package derphttp
 
+import (
+	"context"
+	"net"
+	"net/url"
+
+	"tailscale.com/tailcfg"
+)
+
 func SetTestHookWatchLookConnectResult(f func(connectError error, wasSelfConnect bool) (keepRunning bool)) {
 	testHookWatchLookConnectResult = f
 }
 
+func (c *Client) DialNodeUsingProxy(ctx context.Context, n *tailcfg.DERPNode, proxyURL *url.URL) (net.Conn, error) {
+	return c.dialNodeUsingProxy(ctx, n, proxyURL)
+}
+
 // breakConnection breaks the connection, which should trigger a reconnect.
 func (c *Client) BreakConnection(brokenClient *Client) {
 	c.mu.Lock()