fix: handle half close gracefully

[dobrac]

Note

Improves TCP firewall proxy robustness and simplifies connection handling.

• Migrates from inet.af/tcpproxy to github.com/inetaf/tcpproxy and updates imports
• Removes custom connection metadata/listener (connmeta.go, origDstListener) in favor of tcpproxy.UnderlyingConn and direct sandbox/original-dst lookup in connectionHandler
• Refactors handler wiring: newConnectionHandler now takes ctx and *sandbox.Map; routes updated accordingly in proxy.go
• Keeps domain vs CIDR routing behavior; minor clarifications in handlers.go comments
• Integration tests: add gnupg to template and new TestGPGKeyserverWorks to verify HKP (port 11371) and correct TCP half-close handling

^{Written by Cursor Bugbot for commit bedaadb. This will update automatically on new commits. Configure here.}