The hardcoded noise range (2500-4700 bytes) in the FakeTLS ServerHello
does not match the real certificate chain sizes of many popular fronting
domains (e.g., dl.google.com ≈ 6480 bytes, microsoft.com ≈ 13004 bytes).
This makes the proxy detectable by DPI systems that compare the
ApplicationData size with the real cert chain size for the SNI domain.

On startup, probe the fronting domain's actual TLS handshake size and
use the measured value ± jitter instead of the static range. Falls back
to the legacy 2500-4700 range if the probe fails.

Also adds optional caching of probe results between restarts
(noise-cache-path, noise-cache-ttl) and a configurable probe count
(noise-probe-count) under [defense.doppelganger].

Closes #408

Update stale codeql configuration

Update PGO

Fix build with profiling

Allow using directory bind mounts for a docker container

This helps with a situation when some applications do not allow mounting
individual files, but whole directories. In that case users could mount
`/config` directory with a single file, `config.toml`: `-v
/path/to/dir:/config`. Also, there is a backward compatibility to using
a single `/config.toml`

Add more architectures for mtg

Document a necessety of increasing limits for systemd unit

Add PGO

It seems that default DynamicUser limits are very low. We have to
increase them anyway.

Avoid double buffering in TLS hot path

Optimize waiting time for TLS chunker

Show ip of telegram endpoints in event stream

Fix flaky test

fix: ensure network.Dial and MakeHTTPClient use socks5 proxy

The package `network/v2/proxy_network.go` does not wrap `network.Dial`
and `network.MakeHTTPClient`, which causes them to bypass the SOCKS5
proxy and initiate TCP connections directly from the local machine.

Fix preferIPOnlyIPv6