Validate WRP.Source for inbound messages

[joe94]

The main logic introduced is summarized here: https://github.com/xmidt-org/webpa-common/pull/507/files#diff-4908257ccaf67982253a9806f535dd1dR75

[codecov]

Codecov Report

Merging #507 into main will increase coverage by 0.02%.
The diff coverage is 70.21%.

@@            Coverage Diff             @@
##             main     #507      +/-   ##
==========================================
+ Coverage   86.58%   86.61%   +0.02%     
==========================================
  Files         186      186              
  Lines        8321     8360      +39     
==========================================
+ Hits         7205     7241      +36     
- Misses        912      913       +1     
- Partials      204      206       +2     

Impacted Files	Coverage Δ
device/options.go	88.88% <55.55%> (-6.67%)	⬇️
device/manager.go	59.85% <69.69%> (+2.33%)	⬆️
device/metrics.go	100.00% <100.00%> (ø)
device/drain/drainer.go	96.96% <0.00%> (+1.51%)	⬆️
device/device.go	69.81% <0.00%> (+1.88%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 054e02e...dcfe2de. Read the comment docs.

[JC000]

As long as it isn't some sort of coding error on our part, there shouldn't be a device identifier that is different between a message (simple event message or otherwise) source and the device identifier of the "connection" (connection context). The only possible exception is an empty source. I think it's OK to populate an empty source field, but a different source is an indication of something malicious. Log a security exception and drop the message on the floor.

[kcajmagic]

why is this private?

[joe94]

We don't need it elsewhere outside the package. We do need the "Type" to be exported for viper to work properly.