[recovery] send an INITIAL probe when handshake key is unavailable

If the server ACKs all the client's INITIAL packets but the client doesn't
yet have a HANDSHAKE key, we need to send out a PING frame in an INITIAL
packet. Ensure this packet is padded to gain anti-amplification credit.

src/aioquic/quic/connection.py

@@ -2567,8 +2567,11 @@ def _write_handshake(
             # PING (probe)
             if (
                 self._probe_pending
-                and epoch == tls.Epoch.HANDSHAKE
                 and not self._handshake_complete
+                and (
+                    epoch == tls.Epoch.HANDSHAKE
+                    or not self._cryptos[tls.Epoch.HANDSHAKE].send.is_valid()
+                )
             ):
                 self._write_ping_frame(builder, comment="probe")
                 self._probe_pending = False

src/aioquic/quic/packet_builder.py

@@ -273,7 +273,7 @@ def _end_packet(self) -> None:
             if (
                 self._is_client
                 and self._packet_type == PACKET_TYPE_INITIAL
-                and self._packet.is_crypto_packet
+                and self._packet.is_ack_eliciting
                 and self.remaining_flight_space
                 and self.remaining_flight_space > padding_size
             ):