Handle unknown client NAT type better to reduce load on restricted proxy pool

We're seeing a large number of clientpolls with unknown NAT types:

To be safe, we treat unknown client NATs the same as restricted client NATs, so they pull from the smaller pool of proxies that are known to work with symmetrics NATs. It's possible we can relieve at least some of the pressure on this proxy pool by having unknown clients first try proxies from the unrestricted pool and then fall back to the restricted pool if there is a failure to connect.