[Server] Parse the rightmost address from forwarded header lists (#7586)

X-Forwarded-For carries a comma-separated list, and constructing a
QHostAddress from the raw header value returns a null address for it, so a
configured X-Forwarded-For or a multi-hop header never resolved and websocket
clients stayed on the proxy's address.

- Add parseForwardedAddress, returning the rightmost usable entry of a
  forwarded header list
- Use it for the websocket handshake instead of parsing the raw value
- Exempt loopback from per-address auth rate limits so a same-host proxy with a
  customized trusted_sources list cannot lock every user out
- Add forwarded_address_test

Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>

servatrice/src/serversocketinterface.cpp

@@ -22,6 +22,7 @@
 
 #include "deck_tag_serialization.h"
 #include "email_parser.h"
+#include "forwarded_address.h"
 #include "libcockatrice/protocol/pb/admin_commands.pb.h"
 #include "libcockatrice/protocol/pb/developer_commands.pb.h"
 #include "libcockatrice/protocol/pb/moderator_commands.pb.h"
@@ -4560,8 +4561,7 @@ void WebsocketServerSocketInterface::initConnection(void *_socket)
         // Only trust the forwarded header if the connection itself comes from a trusted proxy,
         // otherwise a client could spoof its address to bypass bans and rate limits.
         if (isTrustedSource(servatrice->getTrustedSources(), socket->peerAddress())) {
-            QString header(socket->request().rawHeader(websocketIPHeader));
-            QHostAddress parsed(header);
+            const QHostAddress parsed = parseForwardedAddress(socket->request().rawHeader(websocketIPHeader));
             if (!parsed.isNull()) {
                 address = parsed;
             }