Optionally verify client certificate IP address

In x509pop and sshpop plugins we could additionally verify the IP address of the client. This would allow administrators which have stable IP addresses to ensure that a client certificate would only be used from the intended location.

This would need to be made optional since current certs likely don't have any IP addresses specified. It would also likely have to stay optional going forward since it wouldn't work with load balancers in front of the server.

To make this work we'd need to:

• Pass the incoming client IP address to the node attestor plugins
• Verify the ip address is present on the certificates the agent presents.