fix(network-stack): challenge-ACK a SYN on an existing session

[TadahiroYamamura]

A3 of #155.

Problem
A SYN on the same 4-tuple as an existing session gets no reply, so when a session is left behind (A2, A4, etc.) the guest's connect() hangs until its SYN retries run out.

Fix
Following RFC 9293 §3.10.7.4 (RFC 5961), answer a SYN that hits an existing session with a challenge ACK and drop the segment. A guest reconnecting with a new ISN answers this unacceptable ACK with an RST, so the existing RST handling removes the old session and the next SYN retransmit opens a new connection.

Tests
A SYN with a new ISN on an existing session gets exactly one challenge ACK, and the session is neither replaced nor has its window overwritten. When the guest then sends an RST, the old session is removed and the next SYN opens a new connection.

Please check

• This does not fix the case where the SYN-ACK was lost and the guest retransmits a SYN with the same ISN. The challenge ACK's ack number (ISN+1) is acceptable to the guest, and a guest in SYN-SENT drops a segment with neither SYN nor RST (§3.10.7.3). The outcome is the same as today, so nothing gets worse. We think this belongs to B6 (SYN-ACK retransmission) in the issue
• There is no rate limit on challenge ACKs (RFC 5961). The existing ACKs for out-of-order payload and duplicate FINs have no limit either, so we followed that

Suggested CHANGELOG entry
Answer a guest SYN that matches an existing TCP session with a challenge ACK, so a stale session no longer blocks reconnecting on the same 4-tuple.

🤖 AI (Claude Code) was used for the investigation and for writing the code.

Contribution Agreement

Please ensure this PR follows the guidelines in CONTRIBUTING.md.

By submitting this pull request, I confirm the following:

I understand that the entity Earendil Inc. (incorporated in the state of Delaware in 2025) needs some rights from me in order to utilize my contributions in this PR. As a contributor I retain all rights, title and interest in and to my contributions, and by keeping this boilerplate intact I confirm that Earendil Inc. can use, modify, copy, and redistribute my contributions, under Earendil Inc.'s choice of terms.