Function proxy_upgrade 

pub async fn proxy_upgrade(
    host: String,
    port: u16,
    path: String,
    tls: bool,
    verify: bool,
    tls_identity: Option<Arc<UpstreamTls>>,
    fwd_headers: &HashMap<String, Vec<String>>,
    client_on_upgrade: OnUpgrade,
    client_is_h2: bool,
) -> Result<Response<Full<Bytes>>, WsError>

Opens the (always HTTP/1.1) upstream WebSocket handshake to host:port at path, and — on a successful upstream 101 — returns the client-facing response and spawns a task that relays bytes between the client and upstream once the client connection upgrades.

client_is_h2 selects the client-facing semantics:

• false (HTTP/1.1 client): forward the client’s Sec-WebSocket-* headers to the upstream and return a 101 Switching Protocols echoing the upstream’s Sec-WebSocket-Accept.
• true (HTTP/2 RFC 8441 client): the client sent no Sec-WebSocket-Key, so synthesize one (and Version: 13) for the upstream handshake, and return a 200 OK (extended CONNECT success) with no Sec-WebSocket-* headers.

fwd_headers are the client request’s headers (name → values); only the WebSocket-relevant ones are forwarded. client_on_upgrade is the client’s [OnUpgrade] captured by the listener before the request was consumed; it resolves only after the returned response is written back to the client.

tls_identity, when set, is the per-upstream client certificate (and private CA) to present during the wss handshake; None falls back to the shared verified/insecure connector selected by verify.