CVE-2026-74696: tcp: fix TFO max_qlen accounting across reuseport migration

In the Linux kernel, the following vulnerability has been resolved:

tcp: fix TFO maxqlen accounting across reuseport migration

A listener's TCPFASTOPEN maxqlen stops being accurate and lets through far more pending Fast Open requests than it was configured for.

This only shows up with SOREUSEPORT listener migration, where closing a listener hands its still-pending TFO children over to a surviving one.

fastopenq.qlen is charged in tcpfastopencreatechild() when the child is created and uncharged in reqskfastopenremove() when the handshake completes. The uncharge follows rsklistener of the request the child points at, and inetreqskclone() has repointed the child at a new request owned by the new listener, so the ++ and the -- land on two different sockets. The new listener's qlen drifts negative and its limit no longer binds.

Charge the new listener during migration, like reqskqueuemigrated() already does for queue->young and queue->qlen.