RPC: Connection limit and fail-ban protection (hardening pt.2)

[SyntheticBird45]

What

This PR follows and is based upon #675

It adds per-IP type simultaneous connection limits similar to monero-project/monero#9765. This PR extends this mitigation by adding a distinction between loopback addresses and private addresses, as well as enabling user to exclude specific IP addresses from any restriction if needed (main production case would be reverse proxies).

This PR also adds a short-term ban mechanism for IP addresses that repeatedly fails to be served by the hyper stack (axum erros are unaccounted). Said banned IP addresses are immediately dropped until they are unbanned.

[redsh4de]

The counter never decays, so this is a 3s ban every 15th failure over the nodes whole uptime. Maybe worth bounding the strikes to a window of a minute or so?

[SyntheticBird45]

@redsh4de , I actually changed the semantic a little bit. There is now two DelayQueue, one for evicting the cache if the IP has stopped causing failure, and another one for if a banned IP's sentence is over.

There is no explicit list of what IP addresses are currently banned because looking up into DelayQueue is O(n) while in practice keeping the current HashMap O(1) (in most cases). So an IP address is effectively banned if its failure reached RPC_FAILURE_BAN_THRESHOLD. That is what is_ip_banned checks.

banned_ips has also been turned into a per_ip_failures HashMap since we don't need concurrency anymore.

Constants can be tweaked but at the moment, an IP address will keep its failure count for 5 second, this timer is reset everytime its increased, and erased when the IP is added to the unban queue.

[redsh4de]

Needs rebase

[SyntheticBird45]

Rebased

[redsh4de]

Suggested change

	address = %addr,
	address = %addr,
	port = %port,