bgp: enforce-first-as

[taspelund]

enforce-first-as is a common security policy option in BGP implementations that ensures routes received from an eBGP peer in ASN X carry an AS-Path whose left-most ASN is X.

This is useful as a baseline mechanism to ensure a peer isn't prepending the AS-Path with ASNs they don't reside within, however must be disabled when peering with an eBGP route-server (e.g. at an IXP) since they do not prepend their own ASN to the AS-Path.

As we add more security options to this BGP implementation, this may be a useful one to add as well.