ACL fixes in core

My recent change to deliver admit's details to the modern admit_ips and admit_hostnames infrastructure overlooked the difference in of non-literal handling host-names.  So I set out to fix that, got confused about which direction I was mapping (dot-subnet to regex was needed, but I'd managed to implement the (much harder) reverse before I realised my mistake) and there was a TODO asking for the reverse anyway, so I ended up implementing both.