Reduce the trackability of QUIC connections

[fmarier]

In #190, we decided not to disable QUIC and looking at chrome://flags/#enable-quic, it is set to the default value (there is also an enterprise policy for it). Loading https://maps.google.com with the devtools open, I can see in the network tab ("protocol" column) that we're making http/2+quic/43 connections.

In light of recently published research, we should probably add a few mitigations to reduce web servers' ability to track using the QUIC protocol.

Here are some proposed mitigations based on the above paper:

• respect server-config expiry but cap it to:
  • 60 min (or 24h if 60 min is too aggressive) for first-party connections
  • 10 min for third-party connections
• ignore server-config update messages
• clear source-address tokens when:
  • IP address changes
  • server-config is cleared