Permit a duplicate knock just from the previous stage

[bobrippling]

This is similar to #72 (only spotted this after I'd written up my solution!), but without the same brute-force concerns.

The difference is that we permit (ignore) a duplicate packet only if it matches the previous stage of the current sequence. I've added more details in the docs:

knock/doc/knockd.1.in

Lines 199 to 204 in 474330a

	.B "AllowDupes"
	Ignore packets (that is, don't invalidate the entire knock), if the packet is a
	duplicate of the sequence stage we've just seen. This may be the case if our
	firewall is configured to drop packets (rather than respond with a rst), so we
	may receive multiple/duplicate TCP syn packets from the knocker, for a single
	stage.

This also allows for browser based knocking, or knocking on a server who will drop packets, where (if we're using something like netcat) we'll send multiple TCP SYNs.