Add external-authorization plugin

This implements an OpenVPN like functionality in that it allows for an optional program to be called after peer authentication that passes an environment variable that contains the authenticated peer's identity. The plugin then allows or forbids IKE_SA establishment based on the programs exit code.