Hostname access_rules check now uses SearchLongestPrefix()

This way, host "www.cfengine.com" will match to the rule ".cfengine.com"
but not to the rule "cfengine.com".

Also it won't happen by accident that "www.cfengine.com" matches to
".com" rule if present together with ".cfengine.com".

Also reshuffled the logic a bit.
Fix reverse lookup in TLS connections.

Because there is no CAUTH command in the new TLS connections, we have to
reverse-lookup the connecting IP address, so that we can check the
admit/deny access_rules later. With this patch we do that *only if*
there are any admit/deny hostname rules. Thus the ugly global
NEED_REVERSE_LOOKUP.

To perform the reverse-lookup within each spawned thread and minimise
latency, we are passing the struct sockaddr that accept() returned to
the spawned thread by (ab)using the ConnectionInfo struct. In the future
I expect the ConnectionInfo and the ServerConnectionState structs to be
unified, ideally with all sub-pointers and sub-allocations merged.
Acceptance tests for admit/deny access_rules using hostnames with new protocol.

Actually they contain subtests for both protocol versions, but the old
protocol is commented out because of our buggy connection cache we can't
have different protocol connections open to the same host.