DoHMaxConnsPerHost controls the maximum number of connections per host.

CipherSuites - custom list of TLSv1.2 ciphers nolint.

RootCAs is the CertPool that must be used by all upstreams Redefining RootCAs makes sense on iOS to overcome the 15MB memory limit of the NEPacketTunnelProvider nolint.

WrappedTransport wraps the default http.Transport so that we can set the query finish time.