OTA source address filtering

**Describe the problem you have/What new integration you would like**
Some of my esphome devices have public IP addresses, and I'd quite like to block external connectivity to OTA. A password helps, but I'd prefer not to expose it at all.

**Please describe your use case for this integration and alternatives you've tried:**
An alternative in some cases might be to set the listen address. Currently the OTA code just uses `socket::set_sockaddr_any()`, which will listen on either IPv6 `::` or the Legacy IP `0.0.0.0` automatically. In some cases, forcing it to listen on Legacy IP only might suffice.

**Additional context**
It could be as simple as making the `on_begin` callback (or a new callback) able to see the connecting address, and *abort* the connection if it wants to. Users could then write their own conditions.

No implementation file or test is named. Start by locating the OTA code using socket::set_sockaddr_any() and the on_begin callback, then determine how a connecting address can be inspected; done should provide a documented way to reject unwanted OTA connections and verify the behavior with tests.

Written by the indexing model from the issue text.