Allow strictly binding tokens to source IP address

[cipherboy]

This adds the option, token_strictly_bind_ip, to strictly bind the
token's approved CIDRs to the source IP address a login request was
associated with. This means if the IP address were ever ported to a
system with a new IP address, the login workflow would have to be
restarted to request a fresh token.

This binding is done in accordance with the X-Forwarded-For header,
allowing the CIDR value to be populated and validated against the
correct end-client's IP address (when sent via trusted X-Forwarded-For
header).

---

This also fixes the rejection of invalid X-Forwarded-For headers:

When x_forwarded_for_reject_not_authorized=false is explicitly set in
the listener configuration, we need to remove the header before
processing the request, otherwise downstream consumers of the request
will not know if the header is authorized or not, and presume that,
because we passed it along, we trusted it.

---

This is missing tests; I might try using the container based testing infrastructure to do this; I think I can run OpenBao within the test suite and use a curl container to check if the binding works. Though, I don't think I'll have the capabilities to test X-Forwarded-For there.

Curious to get your thoughts on this one @thequailman!

Resolves: #32

[cipherboy]

I see, I'll need to address how the number of auth plugins are computed:

2024-03-16T22:56:36.3123147Z === �[31mFailed�[0m
2024-03-16T22:56:36.3123917Z === �[31mFAIL�[0m: command TestAuthEnableCommand_Run/mount_all (2.01s)
2024-03-16T22:56:36.3124851Z     auth_enable_test.go:208: expected 9 credential backends, got 10
2024-03-16T22:56:36.3125964Z         	expected: []string{"ldap", "oidc", "radius", "kerberos", "kubernetes", "userpass", "approle", "cert", "jwt"}
2024-03-16T22:56:36.3127811Z         	backends: []string{"approle", "cert", "jwt", "kerberos", "kubernetes", "ldap", "radius", "token", "userpass", "userpass_binary"}

Perhaps I'll move backend/credential/userpass_binary to vault/external_tests for now.