Long-lived outbound connections no longer hold back server updates

When a server's network proxy is updated, connections a sandbox has open through it, such as SSH sessions, database connections and WebSockets, are passed to the updated proxy with their sockets and buffered bytes, so they stay open and no byte is lost or repeated. Previously each open connection kept an older copy of the proxy running until it closed, and a server with long-lived connections could fall hours behind on updates. HTTPS connections that use egress secrets are decrypted by the proxy and cannot be passed this way: after an update, the next request on such a connection is sent with Connection: close (HTTP/2 connections receive GOAWAY), the response is delivered in full, and the client opens a new connection for the following request.