Forbid TunneledDirConns 0 and PreferTunneledDirConns 0 if being a HS

Fixes bug 10849; bugfix on 0.2.1.1-alpha (I believe)
Merge remote-tracking branch 'public/bug10849_023_bruteforce' into maint-0.2.3
Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4