Intercept remote port forwarding connections and filter out by IP

When using a ForwardedTCPHandler as a request handler for remote port forwarding, it would be nice to be able to reject connections unless their IP is "allowed".

This can be done with an intercept handler which can be set on the `ForwardedTCPHandler` type and then used within `HandleSSHRequest()`.

It could accept a `net.Addr()` and return a true/false result. If true, the incoming connection can be continued as normal but if false, the connection can be closed and thus be rejected.

Use case for this is I'm creating a tool (like Ngrok) that will allow a command such as `ssh -R some-domain:5000:localhost:3000 some-domain -p 2222` to be run locally which will allow people to make requests to `http://some-domain:5000` and it will forward the request to an app running locally. However by doing so, anyone could get hold of that URL and send requests to me..... By allowing an intercept functionality this can be limited by IP address.