kline should support require-sasl

This is an apparent asymmetry in UBAN for IPs (the DLINE backend) vs. NUH masks (the KLINE backend): one supports require-sasl, the other doesn't. I think this was just because I thought of KLINE as deprecated, but it has some use cases (even under cloaking, KLINEs can be enforced against the true hostname) so we should probably make it work.