dos: Block single hop clients at the intro point

This is so we remove load from spammy single hop clients at the Intro point.

Opened after discussion in #24902 (moved).

Lets consider this also as a possible backport.