Allow H2C (unencrypted HTTP/2) to mitigate against HTTP desync attacks

HTTP/2 mitigates against an entire class of vulnerabilities called "HTTP desync attack" or "HTTP smuggling". In short, this means because the backend connection between the reverse proxy and Radicale is shared between all users, an attacker can see content from users connecting to Radicale. This includes cookies, access tokens and maybe passwords.

It is *not* sufficient (actually has no effect) if you upgrade the frontend (between reverse proxy and web browser) connection to HTTP/2. Also, while reverse proxies try to protect against known attack vectors via regular expression hacks, new vectors come up frequently. The only known way to protect against these attacks is upgrade the backend to HTTP/2.

Radicale currently rejects H2C connections:

`[1/Thread-2 (process_request_thread)] [ERROR] An error occurred during request: code 505, message Invalid HTTP version (2.0)`

I was not able to find any configuration in the documentation about HTTP/2 or H2C. My proposal:

- Allow H2C and default to it
- Motivate existing users to switch from HTTP/1.1 to H2C
- Later, disable HTTP/1.1

More info:
https://www.youtube.com/watch?v=PUCyExOr3sE&t=2191s
https://http1mustdie.com/

The issue names no implementation files or tests. Start by locating Radicale’s request-handling entry point that rejects HTTP/2.0, then trace how backend protocol configuration is documented and tested. Done means H2C is supported with a defined default and existing users are given a clear migration path from HTTP/1.1.

Written by the indexing model from the issue text.