ocaml-conpool: mark connection as private_modules
connection.mli opens with "Internal connection representation" and
Connection is not re-exported from conpool.mli (unlike Endpoint,
Config, Stats, Cmd). Marking it private enforces the internal label
at the compiler level and silences merlint E605 for this helper
module.