Create a "localhost" filter (prevent requests from IP addresses which
differ from the server) for paths /local/*, and use it to create a
local collections API to simplify use of the TDM for the use case of
the TDM when running on the same machine as the TDS.

When making a request to the local API, we check that the IP address
associated with the request comes from the same IP address that the
server is listening on locally though the use of a servlet filter. This
will prevent simple external requests to the local API, but the request
IP address can can be spoofed and thwart this. This commit adds an
additional check - a signature based authorization - to the local API.
At this point, only GET requests are supported. An HMAC SHA256 algorithm
is used to generate a hash of the the path and query components of the
request, along with the ISO formatted date/time (rounded down to the
nearest 5 second boundary). The client and server must have access to
the same key used to initialize the hash generator. This hash is sent
with the request as a header (key: X-TDS-Local-Api-Signature-V1). Upon
receipt, the server generates a hash in a similar manner. If the hashes
do not match, the server will respond with a 404. By adding the
date/time string to the hash calculation, we limit the window in which a
request is valid to 5 seconds. The server generates a has using the
current five minute window, and if that fails, it will generate the hash
using the previous 5 minute window.