Support for BoringTun over TCP

There was a similar feature request in WireGuard mailing list[1], and Tunsafe (another implementation of the WireGuard protocol in the userspace) has already supported this feature in their beta version.

Though Wireguard kernel version may not want to support this feature for various reason, but I think this is a good idea to support this feature in the userspace Wireguard implementation.

Various ISP providers and corporate drop/block UDP packets, so it is useful to have this feature in these situations. Also most VPN traffic obfuscation techniques require a TCP connection instead of UDP. VPN traffic obfuscation is useful in countries where Internet censorship is applied (quote from [2]).
Though the BoringTun over TCP's performance can be much worse than the UDP based one, I think these users can also accept this fact.

So I want to proposal BoringTun
1. Support for BoringTun over TCP.
2. Support for masquerading TCP connections as HTTPS traffic.
3. Support for encrypted SNI and also letting user custom the SNI URLs (unencrypted) on the above HTTPS traffic obfuscation mode.

TunSafe has a documentation for their TCP implementation[3], I think this is a good reference. It's a good thing If BoringTun can collaborate with TunSafe author to improve this spec. You can see TunSafe's TCP support details in their changelog[4] (TunSafe v1.5-rc2).

Thanks.

[1]: https://lists.zx2c4.com/pipermail/wireguard/2018-September/003389.html
[2]: https://lists.zx2c4.com/pipermail/wireguard/2018-September/003407.html
[3]: https://github.com/TunSafe/TunSafe/blob/master/docs/WireGuard%20TCP.txt
[4]: https://github.com/TunSafe/TunSafe/blob/master/installer/ChangeLog.txt