tcp: fix reject

Don't get a tx because we don't need to queue the send.
Since the app does not have the connection, it is safe to immediately
send the reply and then close the connection.

This also fixes the bug where we returned the wrong tx_id
for the CONNECT_REQUEST.
tcp: cleanup handling of conn_reply

Fix locking bug (used the wrong lock)
Don't leak the connect tx if it is rejected
Don't remove the conn from the active list twice (when rejected)