WIP: establish ncat proxy when SSH-tunneling to unix socket

We really don't want to break `fleetctl --tunnel` when we switch the default fleetctl driver to the fleet API. The fleet API is only deployed on /var/run/fleet.sock. This is a problem as the SSH forwarding protocol does not support tunneling over TCP to unix sockets. 

The approach of this PR is to establish an SSH tunnel to the target machine that hosts an ncat proxy between a TCP port and a unix socket. This allows fleetctl to dial that ncat-hosted TCP socket through a second SSH tunnel.

Assuming this isn't incredibly stupid, the one last piece to cover here is how to pick an ephemeral port on the target machine and communicate that back to fleetctl on the user's machine. Right now it's hard-coded, which I know needs to change before this merges.