[Server] Parse the rightmost address from forwarded header lists (#7586)

X-Forwarded-For carries a comma-separated list, and constructing a
QHostAddress from the raw header value returns a null address for it, so a
configured X-Forwarded-For or a multi-hop header never resolved and websocket
clients stayed on the proxy's address.

- Add parseForwardedAddress, returning the rightmost usable entry of a
  forwarded header list
- Use it for the websocket handshake instead of parsing the raw value
- Exempt loopback from per-address auth rate limits so a same-host proxy with a
  customized trusted_sources list cannot lock every user out
- Add forwarded_address_test

Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>

servatrice/servatrice.ini.example

@@ -42,9 +42,11 @@ websocket_host=any
 websocket_port=4748
 
 ; If websockets are served through a reverse proxy (e.g. nginx), the real client address can be
-; read from an HTTP header such as X-Forwarded-For. The header is ONLY trusted when the websocket
-; connection itself originates from an address listed in security/trusted_sources (default 127.0.0.1,::1),
-; so that clients cannot spoof their address to bypass bans or rate limits.
+; read from an HTTP header such as X-Real-IP or X-Forwarded-For. A comma-separated X-Forwarded-For
+; list resolves to its rightmost entry, which is the one the proxy appended. The header is ONLY
+; trusted when the websocket connection itself originates from an address listed in
+; security/trusted_sources (default 127.0.0.1,::1), so that clients cannot spoof their address to
+; bypass bans or rate limits.
 web_socket_ip_header=
 
 ; When database is enabled, servatrice writes the server status in the "update" database table; this