HTTPUpgrade client: Close the connection when the upgrade fails

When the upgrade request could not be sent, or the server did not answer
with a valid "101 Switching Protocols", the dial returned the error and left
the TCP connection open until the garbage collector closed it.

With "fingerprint": "unsafe", a failed TLS handshake is one of these cases.
Go's TLS does the handshake at the first write, and here the first write is
the upgrade request.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>

transport/internet/httpupgrade/dialer.go

@@ -111,6 +111,7 @@ func dialhttpUpgrade(ctx context.Context, dest net.Destination, streamSettings *
 
 	err = req.Write(conn)
 	if err != nil {
+		conn.Close()
 		return nil, err
 	}
 
@@ -123,6 +124,7 @@ func dialhttpUpgrade(ctx context.Context, dest net.Destination, streamSettings *
 	if transportConfiguration.Ed == 0 {
 		_, err = connRF.Read([]byte{})
 		if err != nil {
+			conn.Close()
 			return nil, err
 		}
 	}