feat: use TLS for https URLs and send Host

[dwisiswant0]

PipelineClient.do() parsed the request URL but kept only the path and
query, and NewPipelineClient() never set IsTLS on the underlying
clientpipeline.PipelineClient. Every request went out in plaintext,
even for https URLs, and TLS servers answered
400 "Client sent an HTTP request to an HTTPS server".
PipelineOptions.AutomaticHostHeader, true by default, was never read
either, so requests had no Host header and net/http servers answered
400 "missing required Host header".

Use the URL scheme and host, as Client.do() already does. Keep one
clientpipeline.PipelineClient per scheme and pick it by the URL scheme.
Both dial lazily, so the unused one opens no connections. As in Client,
TLS skips certificate verification.

When AutomaticHostHeader is set, send the URL host as the first header
unless the caller already set Host (any case) or the URL has no host.
Unlike Client, keep a caller-supplied Host, so existing pipeline callers
send the same Host as before.

Also set WriteTimeout to Timeout. Without it, the TLS handshake runs on
the first write. A request larger than the 4 KiB write buffer is flushed
before the reader sets a read deadline, so a server that never answers
the handshake blocks the request forever. With WriteTimeout set,
dialAddr() runs the handshake up front under that deadline. Plaintext
writes get the same deadline, as in Client.

Fixes #545