Path MTU discovery fixes and improvements (#3109)

- Existing option `WIREGUARD_MTU` , if set, disables PMTUD and is used
- New option `PMTUD_ICMP_ADDRESSES=1.1.1.1,8.8.8.8` and `PMTUD_TCP_ADDRESSES=1.1.1.1:443,8.8.8.8:443`
- ICMP PMTUD now targets external-by-default IP addresses
- New TCP PMTUD (binary search only) as a second MTU confirmation and fallback mechanism.
- Force set TCP MSS to MTU - IP header - TCP base header - "magic 20 bytes" 🎆
- Fix #3108

internal/vpn/run.go

@@ -47,7 +47,13 @@ func (l *Loop) Run(ctx context.Context, done chan<- struct{}) {
 			continue
 		}
 		tunnelUpData := tunnelUpData{
-			vpnType:        settings.Type,
+			pmtud: tunnelUpPMTUDData{
+				enabled:   settings.Type != vpn.Wireguard || *settings.Wireguard.MTU == 0,
+				vpnType:   settings.Type,
+				network:   connection.Protocol,
+				icmpAddrs: settings.PMTUD.ICMPAddresses,
+				tcpAddrs:  settings.PMTUD.TCPAddresses,
+			},
 			serverIP:       connection.IP,
 			serverName:     connection.ServerName,
 			canPortForward: connection.PortForward,