fix(server): reject --allow-super with --stdio, fix module host-list append

Re-review findings on the C3/C4 hardening branch:

- --stdio is the SSH transport whose remote argv is composed by the client
  (including via --remote-option), so accepting --allow-super there let a
  client defeat the C3 secure default for a root receiver.  Reject it at CLI
  parse time (standalone TCP only) and force the process-global flag off for
  --stdio as defense in depth.  Correct the help text and README/RSYNC_COMPAT:
  the --stdio argv is client-composed, super stays off, and a forced command is
  needed if the default must hold.
- daemon_conf: the per-module 'hosts allow'/'hosts deny' call sites passed
  module_name and replace in the wrong order, so multiple lines replaced
  instead of appended and the empty-value error omitted the module name.  Pass
  (module->name, false) like the global keys; add a unit test for two
  per-module allow/deny lines appending.
- tls: read the client CN via ASN1_STRING_to_UTF8 so an exactly-required-length
  name is accepted and only actual over-length CNs are rejected.

src/server/server_cli.c

@@ -267,8 +267,20 @@ int server_cli_parse(int argc, char* argv[], ServerCliOptions* opts, char* err,
   }
   if (opts->allow_super && opts->daemon_mode) {
     set_error(err, err_size,
-              "--allow-super is for a standalone/--stdio server; daemon modules opt in per "
-              "module with 'client owner = yes'");
+              "--allow-super is for a locally-launched standalone TCP server; daemon modules opt "
+              "in per module with 'client owner = yes'");
+    return -1;
+  }
+  /* --stdio is the SSH transport: the remote server argv is composed by the
+   * CLIENT (directly and via --remote-option), so a client could otherwise pass
+   * --allow-super to a root --stdio receiver and defeat the C3 secure default.
+   * Never honor it there; the super mode stays forced OFF.  An operator who
+   * must keep the historical permissive behavior over SSH has to launch the
+   * receiver through a forced command, not via client-composed argv. */
+  if (opts->allow_super && opts->stdio_mode) {
+    set_error(err, err_size,
+              "--allow-super is not accepted with --stdio (the remote argv is client-composed; "
+              "use a forced command if the default must hold)");
     return -1;
   }
   if (opts->hash_iterations_set && opts->hash_credentials_file == NULL) {