Add possibility to match using SNI and source address

[georgmu]

The Matcher has a context parameter, which is only initialized with context.TODO()

When doing some basic ACL stuff (e.g. allow access for sni foo from 10.0.0.0/8, deny from all), it would be nice to somehow have the source available in the matcher function. Since there already is a context, it would be nice to add the source to this context.

[georgmu]

I solved the problem by wrapping the DialProxy in a ACLDialProxy, doing the subnet matching in HandleConn before calling HandleConn of the DialProxy.

Accessing the connection in the match function would still be nice