[MigueloMadeira]

Summary

When the server runs with --disable-forward, refused outbound channels were only logged with Debugf, so they never showed up unless the server runs with -v. They are now logged at info level, with the requested target:

server: session#1: tun: Denied outbound connection to "127.0.0.1:18181"

• The target comes from the client, so it is quoted (%q): a value containing newlines can't add fake lines to the log.
• The session's Open (user=… addr=… remotes=…) line, already at info level, identifies who attempted it.
• Same approach as the ACL refusal right next to it, which already logs at info.
• The line only fires when a forward remote is actually used, so log volume stays negligible.

Changes

• share/tunnel/tunnel_out_ssh.go: Debugf("Denied outbound connection") → Infof("Denied outbound connection to %q", target)
• share/tunnel/tunnel_out_ssh_test.go: new unit test
• README.md: changelog line

Validation

• New test: the refusal is logged at info level without debug, with the quoted target, and stays on a single line when the target contains a newline. It fails with the previous Debugf.
• go vet is clean; the server, share/tunnel and test/e2e tests pass. The full go test ./... has the same 4 failing tests as master (keepalive and retry-interval), nothing new.
• Real run: a server with --reverse --disable-forward and no -v, a client with a forward remote, one request through it → the server logs tun: Denied outbound connection to "127.0.0.1:18181".

Follow-up

• Release as v1.12.0-os.4