services: add tor.* options

Split `enforceTor` into `tor.proxy` and `tor.enforce`.
By enabling `tor.proxy` without `tor.enforce`, a service can accept
incoming clearnet connections.
E.g., this allows setting up a Tor-proxied bitcoind node that accepts
RPC connections from LAN.

modules/rtl.nix

@@ -89,7 +89,7 @@ let
         description = "Swagger API documentation server port.";
       };
     };
-    inherit (nbLib) enforceTor;
+    tor.enforce = nbLib.tor.enforce;
   };
 
   cfg = config.services.rtl;
@@ -214,7 +214,7 @@ in {
         Restart = "on-failure";
         RestartSec = "10s";
         ReadWritePaths = cfg.dataDir;
-      } // nbLib.allowedIPAddresses cfg.enforceTor
+      } // nbLib.allowedIPAddresses cfg.tor.enforce
         // nbLib.nodejs;
     };