ssh: check TCP flow source process on client?

One thing we could do to make people more comfortable with Tailscale SSH (both accept+check mode) is to (optionally?) verify the source process of TCP connections.

So if e.g. the SSH connection is coming from spotify.exe or Discord or Chrome, maybe we block it by default. (See https://twitter.com/BillDemirkapi/status/1539748451457581056)

Threat being: untrusted code running on the host that has network access (can use the Tailscale routes via tailscaled) but doesn't have filesystem/etc access (so can't read SSH private keys from disk).

Note that the client may not know whether the target is regular SSH or Tailscale SSH, so likely we implement this with peerapi: the Tailscale SSH server can ask the client (over peerapi) to map the TCP flow's source port to a client PID and see if the process looks legit.

/cc @maisem @mayakacz