Add CurveAllowedClients: server-side CURVE client public key whitelist

[Copilot]

CURVE server sockets had no built-in way to restrict which clients could connect based on their long-term public key, making it impossible to implement a client whitelist without an external ZAP handler.

Changes

• Options — HashSet<byte[]> CurveAllowedClients (backed by ByteArrayEqualityComparer)
• SocketBase — Internal CurveAllowedClients property that exposes m_options.CurveAllowedClients directly, without routing through the ZMQ socket option infrastructure
• CurveServerMechanism.ProcessInitiate() — After vouch verification, rejects the connection if CurveAllowedClients is non-empty and the client's long-term public key is absent. Uses Span<byte> to stay zero-allocation when no whitelist is configured; allocates byte[] only for the HashSet lookup when needed
• SocketOptions / ThreadSafeSocketOptions — Exposes HashSet<byte[]> CurveAllowedClients property, backed by the SocketBase internal property

Usage

var serverCert = new NetMQCertificate();
using var server = new DealerSocket();
server.Options.CurveServer = true;
server.Options.CurveCertificate = serverCert;

// Permit only known clients — leave empty to allow all (existing behaviour)
var trustedClient = new NetMQCertificate();
server.Options.CurveAllowedClients.Add(trustedClient.PublicKey);

server.BindRandomPort("tcp://127.0.0.1");

Clients whose long-term public key is not in the set are rejected during the CURVE handshake before any application messages are exchanged.

[drewnoakes]

@copilot I don't think we can just add this here. These are standardised across ZeroMQ libraries.

[Copilot]

Good catch. CurveAllowedClients has been removed from ZmqSocketOption entirely. It is now a NetMQ-specific internal property on SocketBase (backed directly by m_options.CurveAllowedClients), and SocketOptions/ThreadSafeSocketOptions expose it by accessing that property directly without routing through the ZMQ option infrastructure. (commit 2f44dd2)