Shared SSLContext can race between HTTP/1.1 and HTTP/2 connections via ALPN mutation

[MaciejZet]

Summary

The current master mutates a caller-provided ssl.SSLContext in
HTTPConnection._connect():

ssl_context.set_alpn_protocols(["http/1.1", "h2"] if self._http2 else ["http/1.1"])

When two concurrent connections share the same context, one configured with
http2=False and one with http2=True, the ALPN configuration can race.

Reproduction

Using current master at 10a658221deb38a4c5b16db55ab554b0bf731707, a deterministic
fake network backend synchronizes both start_tls() calls.

Observed:

writes:
[("http/1.1",), ("http/1.1", "h2")]

observed:
h2 -> ("http/1.1", "h2")
h1 -> ("http/1.1", "h2")

The HTTP/1.1 connection receives the ALPN list written by the concurrent HTTP/2
connection.

The same behavior reproduces in:

• async connections;
• sync connections;
• async HTTP proxy tunnel connections.

Expected behavior

One connection should not change the TLS protocol configuration observed by
another connection merely because they share a caller-provided SSLContext.

Question

Is sharing a caller-provided SSLContext between connections with different
http2 settings supported? If so, should httpcore isolate the ALPN configuration
per connection instead of mutating the shared context?