HTTPS support

Instead of tunneling the socket provided on the `connect` event to the target server, connect to a local HTTPS server and present a self-signed certificate that matches the target hostname and is signed with a CA that's been installed--check mitmproxy to see how this is done dynamically before proxying the request normally.

This will allow the `ssl` option to be deprecated and for proxy clients to make HTTPS connections directly and have them signed.

Dear reader: if this would be useful to you, chime in.

## TODO

- [ ] dynamically generate SSL certificates
- [ ] generate a CA cert when installed (cf. mitmproxy)
- [ ] support a custom CA cert via command line / environment options
- [ ] decide whether to export the HTTPS server (which would allow callers to choose to have it listen on a port or a named pipe)
- [ ] clean up the check which determines whether it's operating in proxy (with fully qualified URLs as `req.url`) or endpoint mode (via `CONNECT` with paths)
- [ ] if the HTTPS server is not exported, remove the named pipe on shutdown.
- [ ] deprecate `--ssl`