connlib: how to handle overlapping IP ranges of CIDR resources?

[thomaseizinger]

As part of #4597, I discovered that it is currently possible to add CIDR resources with overlapping IP ranges. We currently use longest_match to select, which resource the user wants to access based on an incoming IP packet.

I don't know if this is intentional or not and I am not sure which resource "wins" here (I think the one that got added first?). I've not been involved in the design decisions here but I think we should disallow overlapping IP ranges.