Don't send telnet commands to spy sockets

send_telnet_cmd() now sends telnet commands/replies directly to the client
socket. This avoid the entire output_thread() teeing of sent data to spy
sockets/buffers (which may not be Telnet at all).

There are some concerns with this change:
- if client_socket isn't writable, will sendsocket() block?
- if output_thread is sending on the same socket, are our 2/3-byte telnet
  commands going to have other output data interleaved within? (seems very
  unlikely)