Let clients choose proxies (without listing all their IPs)

This is practically the same as tpo/anti-censorship/bridgedb#40054

I believe this will require proxies to have identities (#29260), because the client needs to verify that the proxy it connected to is the proxy it chose (also see #22945 (comment 2823461)). Although a non-persistent / rotating identity should be enough.

I think this is the way to solve these:

• #40156
• Partly #28651 (closed) (see comments)
• #31200 (closed)
• #31661
• snowflake-webext#43
• #25598
• #40048 (closed)

It needs to be kept in mind that this will allow several clients to choose the same proxy. But I have not managed to come up with an idea why it could be problematic, as proxies are in control of how many clients they're willing to serve.