Some Puck questions

@maxogden I've been meaning to write something up about locking it down. Right now you can't stop pairing, but you can:

• Hook onto the 'connect' event and disconnect immediately if you don't like the address
  
• Stop advertising completely so nobody can connect
  
• Don't expose the UART service, so even if people can connect they can't access the JS interpreter
  
  

I'm planning on adding support for bonding (the encrypted comms) as that's needed for HID on Windows, and I'll see if I can do something about blocking at the same time - there is this idea of a 'whitelist' of devices that connections will be allowed to.

@CanyonCasa I was wondering about that - the Pico format wouldn't be able to expose all the pins, but I guess that'd be ok - it's still a lot.