Add dynamic cert noise calibration for FakeTLS handshake

The hardcoded noise range (2500-4700 bytes) in the FakeTLS ServerHello
does not match the real certificate chain sizes of many popular fronting
domains (e.g., dl.google.com ≈ 6480 bytes, microsoft.com ≈ 13004 bytes).
This makes the proxy detectable by DPI systems that compare the
ApplicationData size with the real cert chain size for the SNI domain.

On startup, probe the fronting domain's actual TLS handshake size and
use the measured value ± jitter instead of the static range. Falls back
to the legacy 2500-4700 range if the probe fails.

Also adds optional caching of probe results between restarts
(noise-cache-path, noise-cache-ttl) and a configurable probe count
(noise-probe-count) under [defense.doppelganger].

Closes #408

mtglib/proxy_opts.go

@@ -160,6 +160,25 @@ type ProxyOpts struct {
 
 	// DoppelGangerDRS defines if TLS Dynamic Record Sizing is active.
 	DoppelGangerDRS bool
+
+	// NoiseProbeCount is the number of TLS connections to make when probing
+	// the fronting domain's cert chain size for noise calibration.
+	// Default is 15.
+	//
+	// This is an optional setting.
+	NoiseProbeCount uint
+
+	// NoiseCacheTTL is how long a cached cert probe result is considered
+	// valid. Default is 24 hours.
+	//
+	// This is an optional setting.
+	NoiseCacheTTL time.Duration
+
+	// NoiseCachePath is the file path for caching cert probe results
+	// between restarts. If empty, no caching is performed.
+	//
+	// This is an optional setting.
+	NoiseCachePath string
 }
 
 func (p ProxyOpts) valid() error {