dos: Block single hop client at the HSDir

This is so we remove load from spammy tor2web clients at the HSDir level.

Opened after discussion in legacy/trac#24902 (moved).