cli/grpc: add gRPC connections to the Docker Engine's API endpoint

[ndeloof]

- What I did

Added a cli/grpc package providing a single way to establish a gRPC client connection to the daemon's API endpoint, for CLI plugins consuming the daemon's gRPC services (BuildKit's control API today, services published by daemon extensions — moby/moby#53021 — tomorrow).

Connect() (or the lower-level Dial()) hides the transport details of the current docker context:

• native HTTP/2 for daemons with API ≥ v1.53: h2c over the API client's own dialer (unix/npipe sockets, plain tcp, ssh:// and other connection helpers), or an ALPN-negotiated TLS handshake for tcp:// endpoints with TLS material;
• fallback to the deprecated POST /grpc HTTP/1.1 upgrade endpoint for older daemons, as buildx currently hand-rolls.

Also exports Endpoint.TLSConfig() in cli/context/docker (previously private), needed for the ALPN path.

google.golang.org/grpc moves from indirect to direct dependency.

- How I did it

Daemon API version is probed with a plain Ping; the connection is then established with grpc.NewClient using either a custom dialer (h2c, legacy upgrade) or gRPC's TLS credentials (ALPN). See the package documentation for details.

Note — capability signal in Ping
Native connections are probed with a health-check RPC before being returned, because the API version alone cannot be trusted: an intermediary may not relay HTTP/2 even when the daemon advertises native support (Docker Desktop's API proxy today — its engine reports API 1.55 while only the legacy upgrade path gets through). The probe costs one round-trip per Connect on the native path. If the daemon ever exposes an explicit capability signal in the Ping response (e.g. a Builder-Version-style header advertising native gRPC, which an intermediary that doesn't relay HTTP/2 would strip or rewrite), it should replace both the version gate and the probe.

- How to verify it

go test ./cli/grpc/... covers the three paths (h2c over the client dialer, TLS+ALPN, legacy hijack fallback) against a real gRPC server.

- Human readable description for the release notes

Created with: Claude Code

[codecov-commenter]

Codecov Report

❌ Patch coverage is 78.68852% with 13 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
cli/grpc/grpc.go	81.35%	8 Missing and 3 partials ⚠️
cli/context/docker/load.go	0.00%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!

[ndeloof]

Pushed b90d88e: native connections are now probed with a health-check RPC and fall back to the legacy upgrade endpoint on transport-level failure. Rationale: an intermediary may not relay HTTP/2 even when the daemon's API version advertises native support — Docker Desktop's API proxy does exactly that (engine reports API 1.55, h2c dial fails with "server preface … looked like an HTTP/1.1 header", while the legacy upgrade reaches the engine's gRPC server fine, so it is the proxy, not the engine). Covered by TestDialNativeFallsBackToLegacy, and validated end to end from docker/compose#14040: against Docker Desktop the publish now degrades to a clean Unimplemented instead of a transport error, and the native path is unchanged against an h2c-capable daemon.