Fix isCandidate logic

The `len(p.limitTunnelProtocols) == 0` check was intended to skip a heavier
GetSupportedProtocols call, but an empty LimitTunnelProtocols no longer
implies all server entry protocols are candidates.

It can be the case that there is no LimitTunnelProtocols, but a server entry
is not a candidate due to dial port number limits. Or, a server entry may
have only default disabled protocols, in which case there must be a non-empty
LimitTunnelProtocols to enable them. Similarly, upstream proxy and
exclude-intensive may be used to determine whether a server entry has
candidate protocols.

psiphon/controller.go

@@ -1387,13 +1387,12 @@ func (p *protocolSelectionConstraints) isCandidate(
 	excludeIntensive bool,
 	serverEntry *protocol.ServerEntry) bool {
 
-	return len(p.limitTunnelProtocols) == 0 ||
-		len(serverEntry.GetSupportedProtocols(
-			conditionallyEnabledComponents{},
-			p.useUpstreamProxy,
-			p.limitTunnelProtocols,
-			p.limitTunnelDialPortNumbers,
-			excludeIntensive)) > 0
+	return len(serverEntry.GetSupportedProtocols(
+		conditionallyEnabledComponents{},
+		p.useUpstreamProxy,
+		p.limitTunnelProtocols,
+		p.limitTunnelDialPortNumbers,
+		excludeIntensive)) > 0
 }
 
 func (p *protocolSelectionConstraints) canReplay(