Close on owner death during HTTP/1.1 reads; hand tunnel sockets to the conn

[benoitc]

Follow-up to #951, fixing the two limits it left.

Blocking HTTP/1.1 reads. The response is read with a passive recv inside the state callback, so a conn waiting on the server saw its owner's 'DOWN' only once the read returned. recv_data/1 and stream_body_chunk/1 now go through owner_recv/1. It reads in slices of at most 1 s and looks for the owner's 'DOWN' between them. The 'DOWN' is put back in the mailbox, so the state's existing owner clause stops the conn. recv_timeout still bounds the whole read. For pooled conns the behaviour is unchanged, only sooner: the owner's 'DOWN' already stopped them after the read.

Tunnel sockets. CONNECT and SOCKS5 tunnels are dialed in the caller, which stayed the socket's controlling process. After set_owner/2, the socket still closed when the opener died, and active-mode messages went to the opener. start_conn_with_socket now moves the socket to the conn with controlling_process. A caller passing a socket it does not own (not_owner) keeps the old behaviour.

Tests in hackney_direct_owner_tests: the in-flight cases now keep the server silent. New cases cover a blocked async body read, a pooled conn (its max_per_host slot comes back), and set_owner on CONNECT and SOCKS5 tunnels. The 6 new or changed cases fail on master.