nomad port-forward command

Kubernetes has a [port-forward](https://kubernetes.io/docs/tasks/access-application-cluster/port-forward-access-application-cluster/) command that allows operators to dynamically and ephemerally forward a local port to a remote pod for debugging and other operations.

This feature seems particularly useful when using Consul Connect as Connect's mTLS requirements make it difficult for operators to peek at Connectified services.

## Implementation

Port forwarding should use Nomad's existing region-aware RPC infrastructure to allow forwarding ports across regions.

Implementation on the client-side (CNI? driver specific?) is TBD.

## Security

A new ACL capability would be added: `namespace:alloc-net` (name TBD). While port forwarding offers a similarly high level of container access as `namespace:alloc-exec`, this feature should have a distinct ACL to avoid having to give operators remote execution privileges.

No files, tests, or entry points are named. Start by tracing Nomad's region-aware RPC infrastructure and the client-side CNI or driver paths, then resolve the implementation choice and the new ACL capability. Done means port forwarding works across regions with a distinct allocation-network ACL and appropriate security behavior.

Written by the indexing model from the issue text.