Move host filtering to a tower layer

[lexnv]

We have an access control filtering that verifies both the host and origin.

ACL requires the host to be present in the headers, while the origin is optional.
Both values are checked against an allow list, if they are not present in the allow list the
request is denied.

However, for HTTP 2.0 the host is part of the request's uri, see #866.

Move the access control filtering to a tower layer to make this feature optional.

[niklasad1]

Previously we had some something called AccessControl which did:

• CORS / origin filtering
• host filtering

The CORS part has been moved to tower http middleware so we don't have to bother with that anymore and a bunch of opinionated "white/blacklisted" headers.

The access control API is just called host filtering now which is the same as @lexnv stated ☝️ which could be implemented as tower middleware as well to make it optional.