[Server] Parse the rightmost address from forwarded header lists (#7586)

X-Forwarded-For carries a comma-separated list, and constructing a
QHostAddress from the raw header value returns a null address for it, so a
configured X-Forwarded-For or a multi-hop header never resolved and websocket
clients stayed on the proxy's address.

- Add parseForwardedAddress, returning the rightmost usable entry of a
  forwarded header list
- Use it for the websocket handshake instead of parsing the raw value
- Exempt loopback from per-address auth rate limits so a same-host proxy with a
  customized trusted_sources list cannot lock every user out
- Add forwarded_address_test

Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>

servatrice/src/forwarded_address.cpp

@@ -0,0 +1,21 @@
+#include "forwarded_address.h"
+
+#include <QString>
+
+QHostAddress parseForwardedAddress(const QByteArray &headerValue)
+{
+    const QList<QByteArray> entries = headerValue.split(',');
+    for (auto it = entries.crbegin(); it != entries.crend(); ++it) {
+        const QByteArray entry = it->trimmed();
+        if (entry.isEmpty()) {
+            continue;
+        }
+
+        const QHostAddress parsed(QString::fromLatin1(entry));
+        if (!parsed.isNull()) {
+            return parsed;
+        }
+    }
+
+    return {};
+}