enforce allowed hosts when an auth module accepts the login

The Allow list was only checked in CZNC::AuthUser() after the core
password check, so logins accepted by imapauth, cyrusauth or certauth
(including SASL EXTERNAL) ignored it. Check it in CAuthBase::AcceptLogin()
and CClient::AcceptSASLLogin() instead.

test/ClientTest.cpp

@@ -390,3 +390,11 @@ TEST_F(ClientTest, OnSendToClientMessage) {
     EXPECT_THAT(m_pTestSock->vsLines, ElementsAre(msg.ToString()));
     m_pTestModule->bSendHooks = false;
 }
+
+TEST_F(ClientTest, AcceptSASLLoginAllowedHosts) {
+    TestClient client;
+    m_pTestUser->AddAllowedHost("203.0.113.0/24");
+    client.AcceptSASLLogin(*m_pTestUser);
+    EXPECT_THAT(client.vsLines,
+                ElementsAre(":irc.znc.in 904 me :Your host [] is not allowed"));
+}