[netem]: failing tests

[DecFox]

The upgrade to go1.23 led to integration tests relying on netem (https://github.com/ooni/netem) to fail. On closer inspection. We also see that upgrading netem (and gvisor) to go1.23 leads to integration tests failing here: https://github.com/ooni/netem/actions/runs/13941984554/job/39020555639?pr=48.

[hellais]

Adding some context from slack

@DecFox

The TL;DR for the problem is: netem currently supports reading and spoofing the TCP packet but assumes that we receive the entire TLS handshake in one frame: https://github.com/ooni/netem/blob/main/tlsparse.go#L53, which is no longer true since we have also have ECH extensions in the frame now, which causes the handshake to arrive in more than 1 frame. Fixing this would require some work on the netem package as well as the engine, which is why I chose to sideline this for the next release. I am going to continue this work in the diff here: ooni/netem#48 (we also see integration tests for netem failing for the same reason)