Before TLS and application leases exist, admit at most eight handshake attempts per observed IP during one three-second handshake window. Bound the spoofed-origin ledger at 256 entries while retaining s2n's default port and global handshake controls.
Test Plan:
- just test
- just clippy
- per-origin window and spoofed-origin ledger tests
- git diff --check