The p2p packages can now be configured to restrict all communication to
a certain subset of IP networks. This feature is meant to be used for
private networks.

The discovery DHT contains a number of hosts with LAN and loopback IPs.
These get relayed because some implementations do not perform any checks
on the IP.

go-ethereum already prevented relay in most cases because it verifies
that the host actually exists before adding it to the local table. But
this verification causes other issues. We have received several reports
where people's VPSs got shut down by hosting providers because sending
packets to random LAN hosts is indistinguishable from a slow port scan.

The new check prevents sending random packets to LAN by discarding LAN
IPs sent by Internet hosts (and loopback IPs from LAN and Internet
hosts). The new check also blacklists almost all currently registered
special-purpose networks assigned by IANA to avoid inciting random
responses from services in the LAN.

As another precaution against abuse of the DHT, ports below 1024 are now
considered invalid.

The new package contains three things for now:

- IP network list parsing and matching
- The WSAEMSGSIZE workaround, which is duplicated in p2p/discover and
  p2p/discv5.

Port mapper auto discovery used to run immediately after parsing the
--nat flag, giving it a slight performance boost. But this is becoming
inconvenient because we create node.Node for all geth operations
including account management and bare chain interaction. Delay
autodiscovery until the first use instead, which avoids any network
interaction until the node is actually started.

This silences a go vet message about copying p2p.Server in package node.

With the Ethereum Homestead fork is now behind us, we can
assume that everyone runs an EIP-8 capable client.

As we aren't really using the standarized SHA-3

On Windows, UDPConn.ReadFrom returns an error for packets larger
than the receive buffer. The error is not marked temporary, causing
our loop to exit when the first oversized packet arrived. The fix
is to treat this particular error as temporary.

Fixes: #1579, #2087
Updates: #2082

The test expected the timeout to fire after a matcher for the response
was added, but the timeout is random and fired sooner sometimes.

This change makes it possible to add peers without providing their IP
address. The endpoint of the target node is resolved using the discovery
protocol.

This change simplifies the dial scheduling logic because it
no longer needs to track whether the discovery table has been
bootstrapped.

thanks to Felix Lange (fjl) for help with design & impl

The strict matching can get in the way of protocol upgrades.