dos: Block single hop client at the HSDir

This is so we remove load from spammy tor2web clients at the HSDir level.

Opened after discussion in #24902 (moved).