feat: add REJECT_UNKNOWN_USERS option

[jozefrebjak]

Summary

• Add REJECT_UNKNOWN_USERS env var that rejects non-existent users early in the authorize section
• Uses Auth-Type := Reject so the attempt is still logged in radpostauth via Post-Auth-Type REJECT
• Runs on every container start (outside init lock) with duplicate detection
• Skips the authenticate phase for unknown users, reducing unnecessary processing

Motivation

Brute force / dictionary attacks generate large volumes of auth attempts with non-existent usernames (e.g. admin, Cisco, common names). This rejects them earlier while maintaining audit logs.

Usage

REJECT_UNKNOWN_USERS: "true"

Test plan

• Start container with REJECT_UNKNOWN_USERS=true
• Verify unlang block is inserted after first -sql in authorize section of sites-available/default
• Test with non-existent username — verify Access-Reject and entry in radpostauth
• Test with valid username — verify normal authentication flow
• Restart container — verify no duplicate blocks are inserted
• Disable REJECT_UNKNOWN_USERS and restart — verify block remains (idempotent, no removal needed since config is rebuilt from defaults on init)

Closes #6

[jozefrebjak]

Closing in favor of a more effective approach: auth reject logging for fail2ban integration.