Correct return from BusyWith functions after ReceiveCollectCall().

Forwarding its return to our caller wasn't smart: we should return
false either way, because cf-serverd's side of the connection got
closed whether it succeeded (handed off to cf-hub) or failed
(abandoned).  Returning true was leading the caller to call the
BusyWith function again, producing a distracting TLS_Read failure.

In addition, on failure, BusyWithClassicConnection() would - due to a
misguided fall-through - wrongly report an unexpected command, if we
ever let it support call-collect.  Now it returns false.
Assert known constraints, log debug on any success.

ServerTLSPeek() would log the data it peeked, but only when deciding
it has TLS; I'd like to be able to see it also for classic.

As recv() definitely shouldn't return more than the buffer size it was
given, assert this, tweak the first check (any negative is failure,
not just -1, albeit only -1 should happen) and simplify the rest.  The
TLS case wasn't checking got == peek_size (as the CAUTH case did), but
can take this for granted (given the assertions) now.
Include {admit,deny}_{ips,hostnames} in the relevant legacy lists.

Entries provided by admit are delivered both to the legacy ACL list
and to the new ACL system's relevant list for admit_ips or
admit_hostnames; likewise for deny.  However, entries given with these
new controls were only added to the new system's lists, not to the
legacy lists, so parts of the code that still use the legacy lists
were not honouring ACLs set using the new keywords.  Add also to the
legacy lists to fix this, until we're finally rid of the legacy code.
Restructure ServerEntryPoint() to avoid duplication of tidy-up.

I'm about to complicate that tidy-up and I'd rather do it in one place
than five.
Don't mark call-collect as processed until it is.

In cf-serverd's StartServer, we were calling CollectCallMarkProcessed
right after the call to ServerEntryPoint; but that merely spawns a
thread to do the work, it doesn't wait for it to complete.  So mark
the connection info object and move the CollectCallMarkProcessed to
where that gets destroyed - when we've finished delivering our report,
or when we abandon the attempt for whatever reason.
Set policy_server everywhere we set am_policy_hub.

The recent change to replace am_policy_hub with policy_server broke
various things because cf-serverd wasn't seeing the new class defined.
So fix the places that set am_policy_hub without setting its
replacement also.  Also, various of those weren't using the right
metadata, so add a function that sets both classes, to be called by
all the places that used to set am_policy_hub, so that they all use
the right attributes and also set policy_server.