Make the temporary, conservative restrictions from rev 79d9f48c in Go
1.6 permanent, and also don't do automatic TLS if the user configured
a Dial or DialTLS hook. (Go 1.7 has Transport.Dialer instead, for
tweaking dialing parameters)

Fixes #14275

Change-Id: I5550d5c1e3a293e103eb4251a3685dc204a23941
Reviewed-on: https://go-review.googlesource.com/23222Reviewed-by: Andrew Gerrand <adg@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>