Support netmask subsets

Support netmask subsets

This allows to specify sets of addresses which are defined by sharing
the least-common netmask value.

For example, if the allow list contains the following addresses:

        10.0.0.2/24  10.0.0.2/32

then the second address is redundant since it is already included
via the first one. The least-common netmask value is 24; with this
patch a command like

        para_client sender http deny 10.0.0.0/24

will catch both addresses.