Add SOCKS support

[djs55]

It would be good to

• replace the ad-hoc tunnelling protocol used to expose physical ports with SOCKS
• allow traffic from certain IPs to be tunnelled over SOCKS to a remote server. For example the registry traffic could be tunnelled but everything else left alone.

We could use the mirage-compatible library https://github.com/cfcs/ocaml-socks