Announce only the remaining bytes of an upload IO

[OskarEichler]

Summary

Use an upload stream's remaining byte count when it exposes its current position, and clamp a position beyond EOF to zero. Do not rewind or close caller-owned IO.

Reproduction and evidence

Standalone local reproduction:

require 'net/scp'
require 'stringio'
io = StringIO.new('abcdef')
io.pos = 3
channel = {}
Net::SCP.allocate.send(:set_current, channel, io)
p channel[:size] # before: 6; after: 3

The actual state-machine reproduction previously announced six bytes then sent only def. It now announces/sends three. Combined release checks cover StringIO and File, empty sources, offsets past EOF and multiple chunk sizes; local scp interoperability also passes.

Compatibility / breaking changes

No public signature or dependency change. Progress totals for partially consumed streams now describe the bytes actually transferred. Streams without pos retain their existing size behavior. Concurrent source growth/truncation is not addressed.

Verification and limits

• This focused branch passes the existing upstream suite: 36 tests / 70 assertions, Ruby 4.0.6, net-ssh 7.3.3, test-unit 3.7.8 and Mocha 2.1.0; all Ruby commands used rbenv.
• The combined release-based consumer candidate passes the suite with frozen string literals enabled, 10 focused cases, 2,906 model assertions, 24 URI-component assertions and 19 local scp/URI assertions. Combined evidence includes other separately proposed fixes and existing upstream frozen-string corrections; it is not attributed to this patch alone.
• No repository tests added/modified under the consuming project's explicit no-new-tests policy. Reproductions/models ran externally. No deployed servers, SSH connections or production data were used.
• All seven runtime files parse with the Ruby 2.6 parser; actual older-Ruby/Windows/remote-server matrices were not run locally. No upstream lint config exists; targeted lint has the same eight pre-existing warnings, with no new warnings.
• Existing upstream PRs/issues and contribution guidance were checked. Maintainer CI results are pending; no CI pass is claimed.