Restrict routes by a permission system

[Fohlen]

When we implement #197 and #459 we will also need to restrict certain routes to be accessible via the public internet

• only OAuth and serverlist routes should be publicly accessible
• everything else should be denied when the request does not come from localhost
• ideally, route policy should be configurable through a routes-permissions.toml

[Fohlen]

For instance https://www.npmjs.com/package/express-ipfilter could do this..