We should be able to define white lists from the application and use them to enforce p2p connectivity.

The switch should take a closure which runs on the peer handshake so we can control if we finally connect to the peer from some external filter rule. For instance, the closure can send a TMSP Query request to ask the application if we should connect. But which connection should this happen on? Consensus, mempool, a new one? A new one might be valuable - could be used for this, for queries more generally (we could expose Query and Info through tendermint rpc using this new connection), and also potentially for BroadcastTx coming the other way.

Related: https://github.com/tendermint/go-p2p/issues/3