Clarify HTTP/2 data race issue (#47)

Makefile

@@ -36,6 +36,7 @@ build: generate ## Build all packages
 
 .PHONY: generate
 generate: $(BIN)/license-header ## Regenerate code and licenses
+	go mod tidy
 	@# We want to operate on a list of modified and new files, excluding
 	@# deleted and ignored files. git-ls-files can't do this alone. comm -23 takes
 	@# two files and prints the union, dropping lines common to both (-3) and

go.mod

@@ -3,14 +3,14 @@ module github.com/bufbuild/httplb
 go 1.19
 
 require (
+	github.com/jonboulle/clockwork v0.4.0
 	github.com/stretchr/testify v1.8.4
 	golang.org/x/net v0.10.0
 	golang.org/x/sync v0.2.0
 )
 
 require (
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/jonboulle/clockwork v0.4.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	golang.org/x/text v0.9.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect

transport.go

@@ -418,10 +418,12 @@ func (t *transportPool) NewConn(address resolver.Address) (conn.Conn, bool) {
 		return nil, false
 	}
 
-	// NOTE: The Go HTTP2 client does NOT defensively clone the TLS config
-	// before it attempts to mutate it, so we can't share the same TLS config
-	// across multiple connections right now.
-	// TODO: file upstream bug?
+	// NOTE: When using ForceAttemptHTTP2, Go can mutate the TLSClientConfig
+	// without first making a defensive copy. This is intended, though not
+	// documented.
+	// https://github.com/golang/go/issues/14275
+	// TODO: Possibly move to factory, since that's where ForceAttemptHTTP2 is
+	// actually set?
 	opts := t.roundTripperOptions
 	opts.TLSClientConfig = opts.TLSClientConfig.Clone()