Exclude sshuttle from session recording

`sshuttle` runs by executing a command on the remote host, so `sshd` sets `SSH_ORIGINAL_COMMAND` and the tlog wrapper's [catch-all branch](https://github.com/canonical/auditd-operator/blob/44cc9a757110feae12bd5d5ecf14c492260719e9/src/tlog_templates/tlog_wrapper.sh.j2#L38-L39) wraps it in a PTY and records it, making the proxied payloads (HTTP, API responses, etc., anything plaintext through the VPN) written to session logs. That is not intended or useful, and also poses data-exposure risk.

Also, `sshuttle` directs remote log to stderr, which SSH keeps on a separated channel. But the remote PTY is a single stream, so enabling verbose on `sshuttle` command will injects text into sshuttle's binary frames and cause error from client side.

`sshuttle` should be detected and passed through to the user's real shell unrecorded in tlog wrapper.

Start in src/tlog_templates/tlog_wrapper.sh.j2 at the catch-all branch on lines 38-39, then review how SSH_ORIGINAL_COMMAND is handled for sshuttle. The change is done when sshuttle reaches the user's real shell without tlog recording or PTY wrapping, so its binary frames are not corrupted by verbose output.

Written by the indexing model from the issue text.