fix(psycopg): prevent proxy deadlock on TLS 1.3 post-handshake messages

[kgala2]

Summary

Fixes intermittent psycopg.errors.ConnectionTimeout: connection timeout expired failures in CI (particularly on windows-latest and macos-latest, e.g. in test_lazy_psycopg_connection, test_system_psycopg_to_thread, and test_psycopg_connection).

Root Cause

In TLS 1.3 (RFC 8446 §4.6.1), SSLContext.wrap_socket() completes immediately after the client sends ClientFinished, and the Cloud SQL Server Proxy then asynchronously sends a post-handshake NewSessionTicket TLS record.

When that NewSessionTicket arrives in remote's OS socket receive buffer before psycopg writes its PostgreSQL StartupMessage to local (which happens frequently on Windows where _PsycopgProxy uses a local TCP loopback socket 127.0.0.1:<port>), sel.select() in _proxy() wakes up with EVENT_READ on remote and calls remote.recv(8192) on the blocking ssl.SSLSocket. OpenSSL consumes the NewSessionTicket record internally, sees 0 bytes of decrypted application data, and blocks indefinitely inside SSL_read waiting for PostgreSQL to send data first—deadlocking the single-threaded proxy loop so psycopg's StartupMessage on local is never forwarded.

Fix

• Add nonblocking: bool = False to _forward_bytes() and pass nonblocking=True when reading from remote on sel.select() wakeups in _proxy().
• Temporarily set src.setblocking(False) around src.recv(_BUFFER_SIZE) (restoring src.setblocking(True) in finally with contextlib.suppress(OSError)) and return True on (ssl.SSLWantReadError, BlockingIOError) so the selector loop continues without blocking or closing the connection.
• Add unit test test_proxy_tls13_post_handshake_want_read covering this scenario.