Add vanguard configuration options

We have a few options here:

• have a single, global configuration option the says whether to use vanguards-lite, or vanguards-full. This would apply to all HS circuits (to both client and service circuits)
• have separate configuration options for clients and services (the service vanguard config would be per-service). This would enable us to configure clients and services, as well as different services running in the same arti instance, independently from each other (I'm not sure whether this is useful though).

We might also want to add config options for overriding the guard-hs-l2-number, guard-hs-l2-lifetime-min, guard-hs-l2-lifetime-max consensus parameters, so perhaps we need a proper VanguardsConfig (rather than a simple vanguards: auto|lite|full option)

   [onion_services."allium-cepa".vanguards]
   kind = "lite"
   l2_guard_num = 5
   # TODO: there are no consensus params for the l3 guards
   l3_guard_num = 15
   ...