[fix] Reject foreign ZMQ peers at the storage proxy

[huniu20]

Problem

A storage unit binds its put/get ROUTER to a TCP port. Anything that dials that
port is forwarded straight to the worker, and the worker then dies decoding it:
ZMQMessage.deserialize sat outside the worker's try, so one stray payload
terminated the request loop. The actor process, its bound socket and the proxy
thread all stayed up, so requests kept being accepted with nobody left to answer
them and every client blocked until its own timeout.

Fix

1. Filter at the proxy. zmq.proxy() offers no interception point, so the
   proxy now forwards by hand and keeps only the two identity prefixes real peers
   use (storage managers and the metrics collector).
2. Survive bad frames anyway. The filter cannot cover everything: an allowed
   peer can still send frames that fail to decode. Decoding moves inside the
   try, mirroring the controller's request loop, and the peer gets an error
   reply instead of hanging on recv.
3. One source for the prefixes. They now live in zmq_utils and the
   identities are built from them, so a rename cannot silently make every request
   unroutable.

The controller already tolerates undecodable messages, so it needs no change.

Tests

tests/test_simple_storage_unit.py: 17 passed.

• test_foreign_payload_dropped_and_unit_stays_usable — feeds a real TLS
  ClientHello and asserts it draws no reply at all (dropped before the worker,
  unlike a decode failure), then that the unit still serves.
• test_undecodable_request_answered_and_worker_survives — an allowed identity
  sending undecodable frames gets PUT_GET_ERROR and the worker keeps serving.

Each was confirmed to fail when its corresponding fix is reverted.

[ascend-robot]

CLA Signature Pass

huniu20, thanks for your pull request. All authors of the commits have signed the CLA. 👍

[ascend-robot]

CLA Signature Pass

huniu20, thanks for your pull request. All authors of the commits have signed the CLA. 👍