Don't consider ACL'd servers as permalink candidates

and fix the bug where it was picking 4 servers instead of 3. This was due to `<=` instead of `<` in the `MAX_SERVER_CANDIDATES` loop. Added tests for all the things.

Fixes https://github.com/vector-im/riot-web/issues/7752
Fixes https://github.com/vector-im/riot-web/issues/7682

package.json

@@ -72,6 +72,7 @@
     "gfm.css": "^1.1.1",
     "glob": "^5.0.14",
     "highlight.js": "^9.13.0",
+    "is-ip": "^2.0.0",
     "isomorphic-fetch": "^2.2.1",
     "linkifyjs": "^2.1.6",
     "lodash": "^4.13.1",