Investigate PING/SETTINGS-related timing side-channels

We are auditing HTTP/2 for tracking vectors in #14592. But a more difficult question for HTTP/2 (and potentially HTTP 1.x) are timing side channels.