Endpoint: make matchesPattern stricter about pattern types

[kpodosin]

matchesPattern now decides how to compare based on what kind of pattern it's given:

• Address and CIDR patterns only match address endpoints of the same IP family, and never fall back to hostname matching.
• Address patterns are compared by value, so different spellings of the same IPv6 address match.
• Wildcard matching against address text applies to IPv4 only.
• Endpoints other than host and address endpoints never match, even with "*".

Also adds matchesCIDR helpers for IPv4 and IPv6 addresses, and tests covering each rule.