Bracket IPv6 literals in the checker's CONNECT line, targets and judges

[maximilianfeix]

What does this change?

Closes #302

• New netio.authority(host, port) for CONNECT lines (always with the port, IPv6 literals in brackets); the checker's _open_tunnel uses it.
• Target.host_header, Target.label, the URL parse_target builds, Judge.authority and runsteps.browser_get go through netio.host_header instead of formatting host:port themselves.
• CHANGELOG entry.

Note: target sites and judges are still resolved with AF_INET, so an IPv6-only target is turned away before any check (IPv6 was measured and dropped in #1). This only makes the request lines correct wherever a literal does get that far.

How was it tested?

• python3 -m pytest passes (1022 passed, 20 skipped on Windows)
• ruff check . is clean
• tried it for real: the new test starts a local HTTP proxy and reads what the checker sends – CONNECT [2606:4700::1]:443 with the matching Host line. Both new tests fail on main.

Screenshots

n/a