Obfsbridges should be able to "disable" their ORPort

In the future, we will want obfsbridges to only expose their obfsports and not their ORPort, otherwise an adversary can launch an active-scanning attack against the ORPort.

We should spec and implement a torrc option that hides the ORPort of obfsbridges.

Maybe it should make the ORPort bind on localhost. But what happens if the transport proxy is not on the same host as the ORPort?