Allow custom listeners for reverse TCP forwards

[blaubaer]

Summary

• Add an optional listener callback to ForwardedTCPHandler, called after authorization and forward-limit reservation with the original bind host and port.
• Keep the default net.ListenConfig.Listen path; use the bound listener port for SSH replies and cancellation, and close callback listeners on failure, cancel, and disconnect.
• Cover default behavior, hook arguments, port 0, bound-port and origin metadata, limits, errors, cancel, and disconnect.