fix: preserve the configured TLS hostname (#3694)

## Summary

- Preserve the configured TLS hostname and retain explicit transport
settings.
- Add offline sync/async request and TLS regression tests for HTTPX2,
legacy HTTPX, aiohttp, and X.509 forwarding.

## Validation

- Focused and nearby tests: 320 passed, 2 skipped.
- Ruff, formatting, focused Pyright, and focused mypy passed.
- Tests use fake credentials and a loopback-only server with an
ephemeral certificate.