Send first-flight transport closes after post-auth errors

[snvtac]

Summary

• keep first-flight post-auth transport errors sendable instead of immediately marking the connection closed when recv_count is still zero
• prefer an Initial CONNECTION_CLOSE only for authenticated first-flight errors while Initial keys are still available
• extend missing_initial_source_connection_id to verify the server emits an Initial close that the client processes as TRANSPORT_PARAMETER_ERROR

Fixes #2515.

Validation

• git diff --check
• cargo test -p quiche missing_initial_source_connection_id -- --nocapture
• cargo test -p quiche invalid_initial -- --nocapture
• cargo test -p quiche local_error -- --nocapture
• cargo test -p quiche close -- --nocapture
• RUSTFLAGS="-D warnings" cargo test -p quiche --all-targets
• RUSTFLAGS="-D warnings" cargo clippy -p quiche --all-targets -- -D warnings
• RUSTFLAGS="-D warnings" cargo test --all-targets --features=async,ffi,qlog --workspace
• RUSTFLAGS="-D warnings" cargo clippy --features=async,ffi,qlog --workspace -- -D warnings