l4postgres: add user/database, client, and SSL matchers (supersedes #188)

[tannevaled]

What

This supersedes #188 by @metafeather, rebased onto the current hardened MatchPostgres on master. The original PR added three Postgres StartupMessage matchers, but it predated the maintainers' rewrite of the connection detector, so it no longer applied cleanly. This brings the same matching capabilities onto the current detector and fills the gaps the original left. @metafeather is preserved as Co-authored-by: on the commit.

As discussed on #188, this keeps #432 (the postgres_starttls handler) as a separate PR on top. Once this lands I'll close #188.

Matchers

• postgres gains an optional user map (user → allowed databases, * as the wildcard user), applied to the StartupMessage parameters.
• postgres_client matches on the application_name parameter.
• postgres_ssl matches connections that request SSL, or — with disabled — that do not.

postgres {
    user alice planets_db stars_db
    user * public_db
}
postgres_client psql TablePlus
postgres_ssl            # require SSLRequest
postgres_ssl disabled   # require no SSLRequest

How it differs from #188

Faithful to the original design — module IDs and JSON config shapes are unchanged, so existing configs keep working — but elevated to current standards:

• Reuses master's DoS-hardened length/payload bounds checks for all three matchers (via a shared readFirstMessage helper) instead of the unchecked Uint32(head)-4 read, which could underflow on a short message.
• Adds json struct tags so the documented lowercase keys (user, client, disabled) are actually produced.
• Adds UnmarshalCaddyfile to all three matchers (the original was JSON-only), with caddyfile_adapt integration tests.
• 100% statement coverage on the package, verified under -race. The maintainers' existing 388-line TestMatchPostgres is kept and still passes unchanged (behavior of the bare matcher is identical).
• Documentation for all three matchers under docs/matchers/.

Verification

go test ./modules/l4postgres/ ./integration/ -race   # all pass, 100% coverage of l4postgres