[Server] Parse the rightmost address from forwarded header lists (#7586)

X-Forwarded-For carries a comma-separated list, and constructing a
QHostAddress from the raw header value returns a null address for it, so a
configured X-Forwarded-For or a multi-hop header never resolved and websocket
clients stayed on the proxy's address.

- Add parseForwardedAddress, returning the rightmost usable entry of a
  forwarded header list
- Use it for the websocket handshake instead of parsing the raw value
- Exempt loopback from per-address auth rate limits so a same-host proxy with a
  customized trusted_sources list cannot lock every user out
- Add forwarded_address_test

Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>

servatrice/src/servatrice.cpp

@@ -1551,8 +1551,11 @@ bool Servatrice::isRateLimitExempt(const QString &ipAddress) const
 {
     // Mirrors the max_users_per_address bypass in initSession: trusted sources
     // (e.g. 127.0.0.1 for Webatrice behind local nginx, where every websocket
-    // client shares one address) are not subject to per-address limits.
-    return isTrustedSource(getTrustedSources(), ipAddress);
+    // client shares one address) are not subject to per-address limits. Loopback
+    // is always exempt, so a same-host proxy whose forwarded address could not be
+    // resolved cannot lock every user out together when trusted_sources is
+    // customized.
+    return QHostAddress(ipAddress).isLoopback() || isTrustedSource(getTrustedSources(), ipAddress);
 }
 
 void Servatrice::clearFailedLogins(const QString &ipAddress, const QString &userName)