[Server] Parse the rightmost address from forwarded header lists (#7586)

X-Forwarded-For carries a comma-separated list, and constructing a
QHostAddress from the raw header value returns a null address for it, so a
configured X-Forwarded-For or a multi-hop header never resolved and websocket
clients stayed on the proxy's address.

- Add parseForwardedAddress, returning the rightmost usable entry of a
  forwarded header list
- Use it for the websocket handshake instead of parsing the raw value
- Exempt loopback from per-address auth rate limits so a same-host proxy with a
  customized trusted_sources list cannot lock every user out
- Add forwarded_address_test

Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>

servatrice/src/forwarded_address.h

@@ -0,0 +1,18 @@
+#ifndef FORWARDED_ADDRESS_H
+#define FORWARDED_ADDRESS_H
+
+#include <QByteArray>
+#include <QHostAddress>
+
+/**
+ * @brief Parses the real client address out of a forwarded header value (X-Real-IP, X-Forwarded-For).
+ *
+ * A comma-separated list resolves to its rightmost usable entry. That entry was appended by the
+ * proxy closest to the server and is the only one a direct client cannot choose, since the earlier
+ * entries are passed through verbatim from whatever the client sent.
+ *
+ * @return the parsed address, or a null QHostAddress when the value holds none.
+ */
+QHostAddress parseForwardedAddress(const QByteArray &headerValue);
+
+#endif