fix #1428

Tor listeners should never see an STS cap.

Add an undocumented 'hide-sts' key for listeners that hides the STS cap.
This can be used if the listener is secured at layer 3 or 4 (VPNs,
E2E mixnets). It will be necessary to add the relevant IPs to `secure-nets`.

irc/utils/proxy.go

@@ -54,6 +54,7 @@ type ListenerConfig struct {
 	Tor       bool
 	STSOnly   bool
 	WebSocket bool
+	HideSTS   bool
 }
 
 // read a PROXY header (either v1 or v2), ensuring we don't read anything beyond