swarm: QUIC dial failures are not always fed into the dial limiter

Nobody has claimed this yet.

Due to the nature of the TLS 1.3 handshake, it will look like a connection attempt succeed for the client even if the server rejects the client's certificate (for whatever reason).

The handshake looks like this:
```
> ClientHello
< ServerHello, Certificate, Finished
> Certificate, Finished
```

If the server dislikes the client's certificate, it will close the connection immediately. However, at this point, the client has already completed the handshake, so the swarm doesn't register this as a failed dial, and doesn't feed that into the dial backoff. This will lead us to dial the same address again. We even do so explicitly in the host:
https://github.com/libp2p/go-libp2p/blob/4ad3734091da59d91747706a5f49ff0a5cfdad92/p2p/host/basic/basic_host.go#L611-L626
Maybe we should use a `NoDial` context on the `NewStream` call?

This will require us to send error codes: https://github.com/libp2p/specs/issues/479.

Start at p2p/host/basic/basic_host.go around lines 611-626 and review the linked libp2p specification issue about error codes. Trace how QUIC client-certificate rejection is reported after the handshake and how that affects dial backoff. Done means these failures are registered with the dial limiter so the address is not immediately redialed.

Written by the indexing model from the issue text.