Fixes #2214.
Two HTTP/2 robustness fixes for LoadBalance.ROUND_ROBIN, on top of the feature
branch (requests-round-robin-per-host):

1. A permit-starved request now reuses a sibling-IP HTTP/2 connection instead of
   stalling for connectTimeout and then failing (Round-robin: reuse a sibling-IP HTTP/2 connection when the per-IP connection is permit-starved #2214).
2. maxConnectionsPerHost is now actually enforced as a per-host connection cap
   in round-robin mode (it previously only throttled connection establishment).

Two commits:

• Fix #2214: reuse a sibling-IP HTTP/2 connection when permit-starved
• Enforce maxConnectionsPerHost for round-robin HTTP/2

1. Reuse a sibling-IP HTTP/2 connection when permit-starved (#2214)

In round-robin mode each request is pinned to a resolved IP via
RoundRobinPartitionKey(base, IP), but the connection permit is per host. With a
finite maxConnectionsPerHost, a request pinned to IP_B that couldn't acquire a
permit polled only its own per-IP key in the HTTP/2 registry, never found a
connection already open on IP_A, and — off the event loop — spun the full
connectTimeout before failing with the permit exception.

• The HTTP/2 registry (ChannelManager.http2Connections) changes from a flat
  exact-key map into a base-keyed nested map (base host → per-IP key → channel): single source of truth, O(1) exact lookup, sibling lookup scoped to
  the host. Register runs inside compute(baseKey, …) and removal inside
  computeIfPresent(baseKey, …) on the same outer bucket, so a concurrent
  insert/prune can't orphan an entry.
• On the permit-starved path, waitForHttp2Connection falls back to
  pollHttp2SiblingConnection(baseKey) — any active, non-draining connection to
  the same host on a sibling IP — and multiplexes onto it. Multiplexing onto an
  existing HTTP/2 connection takes no permit, so this is safe. The fallback is
  confined to the permit-starved path; the happy path stays strictly per IP, so
  round-robin spreading is unaffected.

2. Enforce maxConnectionsPerHost for round-robin HTTP/2

The per-host permit was released immediately after ALPN (as in DEFAULT mode), so
it only throttled connection establishment. Because each request pins to a
different IP and opens its own connection, a host could accumulate up to one
connection per resolved IP regardless of the cap — it wasn't enforced.

• In round-robin mode the permit is now held for the HTTP/2 connection's lifetime
  (as HTTP/1.1 already does). The per-host semaphore then bounds live connections:
  at most maxConnectionsPerHost (K) connections, spread across K of the IPs; a
  request pinned to a further IP fails to acquire a permit and multiplexes onto a
  sibling (via the fix above) rather than opening another. DEFAULT mode is
  unchanged (one connection per host, released post-ALPN so concurrent requests
  multiplex onto it).

Behavior & compatibility

• DEFAULT mode is unchanged.
• maxConnectionsPerHost now caps live HTTP/2 connections per host in round-robin
  mode. When it's < #resolved IPs, the cap wins over full spreading: K
  connections are held open (kept alive by PING) and stay pinned to K IPs. Set it
  ≥ #IPs for full per-IP spreading. The default is unlimited, so this only
  affects clients that configure a finite per-host cap.
• A live round-robin HTTP/2 connection now also occupies a global maxConnections
  slot for its lifetime.

Testing

• ChannelManagerHttp2SiblingLookupTest (new) — nested registry + sibling lookup:
  active hit, draining/dead/closed skipped, base mismatch ignored, empty-inner-map
  pruning.
• RoundRobinPartitionKeyTest — getBaseKey coverage.
• BasicHttp2Test:
  • permit-starved sibling reuse (concurrent burst, maxConnectionsPerHost=1,
    multi-IP) — completes by multiplexing instead of stalling;
  • spreading regression guard (cap ≥ #IPs → every IP still attempted);
  • cap enforcement (3 IPs, cap=2 → ≤ 2 live connections, all requests succeed).
• Existing HTTP/2 multiplex / orphan / conformance regression suites and
  RoundRobinSendTypeTest pass; the two reflective http2Connections() test
  helpers were updated to flatten the nested map.

Both fixes were adversarially verified: reverting the change makes the sibling
reuse test stall-then-fail, and the cap test report expected <= 2, got 3.

Out of scope

• Active health checks / authoritative failed-IP handling remain the resolver/DNS
  layer's responsibility (round-robin's IP cooldown is only a short-lived dampener).