Add --allowed-bot-ids option to whitelist bots

[yagop]

Adds an optional --allowed-bot-ids command-line option that takes a comma-separated list of bot user identifiers permitted to use the server.

When the option is set, a request whose bot user id is not in the list is rejected with 401 Unauthorized: bot is not allowed to use the server in ClientManager::send, before any Client is created — so unknown bots can't consume server resources (memory, TDLib instances, database entries). When the option is omitted the behavior is unchanged: all bots are allowed.

This complements the existing --filter option: --filter partitions bots across server instances by bot_user_id % modulo, whereas --allowed-bot-ids restricts the server to an explicit allowlist, which is useful for single-tenant or private deployments.

Changes

• ClientParameters: add allowed_bot_user_ids_ (empty means all bots allowed).
• telegram-bot-api.cpp: parse and validate the --allowed-bot-ids option.
• ClientManager::send: reject bot ids outside the allowlist with 401.

[levlam]

The server must be either available only from a private network or to be available through a TLS termination proxy. In the first case it makes no sense to restrict allowed bots. In the second case the restriction is better to be done on the proxy side. The option filter exists only as a sanity check to discard misrouted requests.

[yagop]

I'm running my telegram-bot-api in a public exposed Fly.io instance.

Fly.io handles the TLS certificates (we can't do any kind of authorization). Many other cloud providers may handle the certificates too. Thus the need of --allowed-bot-ids.