rspamd: restrict addresses we disable checks for to localhost

By default this includes private network subnets, but those should really
use authentication instead, if they want to skip checks.

Closes: #326

mail-server/rspamd.nix

@@ -132,6 +132,13 @@ in
           '';
         };
       };
+      overrides = {
+        "options.inc" = {
+          text = ''
+            local_addrs = [::1/128, 127.0.0.0/8]
+          '';
+        };
+      };
 
       workers.rspamd_proxy = {
         type = "rspamd_proxy";