Lock hologram credentials by IP

[copumpkin]

Currently, the temporary credentials are unlikely to leak and they will only last a short time if for whatever reason they do, but it would make me even more comfortable if the credentials were IP-locked.

In practice, this means intersecting the user's requested role with the following policy during the AssumeRole call.

{
    "Version": "2012-10-17",
    "Statement": [ {
        "Effect":    "Allow",
        "Action":    "*",
        "Resource":  "*",
        "Condition": { "IpAddress": { "aws:SourceIp": "my_ip" } }
    } ]
}

A complication is that in some setups (including mine), the IP I use to talk to the hologram server is not the same IP that I use to talk to AWS APIs, so the protocol would need to be amended to allow me to tell the hologram server what my public IP is.

Not sure it's necessarily worth the effort for most users, but it would be a nice cherry on the security cake.

There's also another slight complication, which is that locking by IP isn't currently supported for a handful of API calls. In most use cases, they aren't very common APIs to use. AWS is aware and will likely fix the issue soon.