multiport: make a lane a session on the tunnel, not a tunnel

Lanes used to be separate HostInfos, each with its own handshake, its own
half-established states, its own lifetime and its own slot bookkeeping. That
bought nothing: a lane is the same tunnel over a different underlay 5-tuple.

Derive lane sessions instead. Noise leaves us with A.eKey == B.dKey, so both
sides HKDF-expand the same two keys with the same per-lane label and land on a
matched pair without exchanging anything. Lanes now cost no handshake, have no
half-established state, and die exactly when their base tunnel does. Which lane
a packet belongs to rides the low byte of the nebula header's Reserved field,
inside the AEAD's associated data.

Receiving on a lane needs no permission, since the session exists the moment the
base handshake completes. Sending on one needs proof the new 5-tuple works, so a
lane stays down until a probe on it is acked and falls back to the base tunnel
the moment it stops being acked. Probing is demand-driven off the connection
manager's per-tunnel traffic tick: a peer we exchange a trickle with never costs
more than its base tunnel, however many lanes are configured. The ack rides the
base session on purpose, so a broken reverse lane can't fail a working one.

Because the data now rides lane counters, the rehandshake, exhaustion and
swap-primary checks take the max counter across the base session and its lanes;
otherwise the base counter would sit near zero while a lane ran its keys past
the nonce ceiling.

Removes OutboundLaneTimer, EnsureLanes, startLaneHandshake, completeLane,
completeLaneResponder, makeLaneTrafficDecision and the lane fields on HostInfo.
Handshake payload field 3 (the per-lane handshake index) is permanently
reserved; peers advertise a TxLanes count instead.

header/header_test.go

@@ -52,6 +52,28 @@ func TestParse(t *testing.T) {
 	}
 }
 
+func TestEncodeLane(t *testing.T) {
+	b := EncodeLane(make([]byte, Len), Version, Message, MessageNone, 10, 9, 3)
+	assert.Equal(t, []byte{0x11, 0x0, 0x0, 0x3}, b[:4])
+
+	h := &H{}
+	require.NoError(t, h.Parse(b))
+	assert.Equal(t, uint16(3), h.Reserved)
+	assert.Equal(t, uint8(3), h.Lane())
+
+	// Encode is EncodeLane on the base tunnel, and the H method round trips the lane.
+	assert.Equal(t,
+		EncodeLane(make([]byte, Len), Version, Message, MessageNone, 10, 9, 0),
+		Encode(make([]byte, Len), Version, Message, MessageNone, 10, 9))
+
+	rt, err := h.Encode(make([]byte, Len))
+	require.NoError(t, err)
+	assert.Equal(t, b, rt)
+
+	// Only the low 8 bits of Reserved are the lane.
+	assert.Equal(t, uint8(0x2a), (&H{Reserved: 0xff2a}).Lane())
+}
+
 func TestTypeName(t *testing.T) {
 	assert.Equal(t, "test", TypeName(Test))
 	assert.Equal(t, "test", (&H{Type: Test}).TypeName())
@@ -127,7 +149,9 @@ func TestIsValidSubType(t *testing.T) {
 
 	assert.True(t, IsValidSubType(Test, TestRequest))
 	assert.True(t, IsValidSubType(Test, TestReply))
-	assert.False(t, IsValidSubType(Test, 2))
+	assert.True(t, IsValidSubType(Test, LaneProbe))
+	assert.True(t, IsValidSubType(Test, LaneProbeAck))
+	assert.False(t, IsValidSubType(Test, 4))
 
 	// These types only ever carry subtype 0.
 	for _, mt := range []MessageType{Control, CloseTunnel, RecvError, LightHouse} {