grpc-js: Add security connector, rework connection establishment

[murgatroid99]

This modifies the ChannelCredentials API so that instead of providing the connection options which are used to establish a TLS connection, it provides a SecurityConnector, which is created using information about a specific subchannel, and is responsible for establishing TLS connections on top of TCP connections.

With this change, the steps of establishing an HTTP/2 session are more cleanly divided:

• The transport establishes the TCP connection, potentially delegating to the proxy connection code.
• The security connector establishes the TLS connection on top of the TCP connection (or passes it through untouched, in the case of insecure credentials)
• The transport creates the HTTP/2 session on top of the socket provided by the security connector.