Client address is the right-most untrusted X-Forwarded-For entry (closes #144)

From a peer in TRUSTED_PROXIES, clientIP took the left-most
X-Forwarded-For entry, which the client writes itself behind a proxy
that appends to the header, so a client could choose the address the
rate limit counts and the request log records. It now walks the entries
from the right past trusted proxies and takes the first that is not
one. An entry written as an address with a port is read as that
address; with only trusted entries, or one that is not an address at
all, it uses the peer. Every X-Forwarded-For header line is read.
X-Real-IP is read only when there is no X-Forwarded-For entry.
README.md Settings says which entry is taken, and the comment in
configs/nginx.conf no longer says the backend takes the first entry.

Model: opus-5-5

configs/nginx.conf

@@ -46,7 +46,9 @@ server {
     # 127.0.0.1:8081. These headers go with every request passed to it.
     # X-Forwarded-For carries only the client address, as resolved by
     # the real IP settings above, and not the chain the request came
-    # with: the backend takes the first entry, which a client can write.
+    # with. bin/entrypoint.sh starts the backend with
+    # TRUSTED_PROXIES=127.0.0.1/32, the address nginx connects from, so
+    # the backend takes that one entry as the client address.
     proxy_set_header Host $host;
     proxy_set_header X-Real-IP $remote_addr;
     proxy_set_header X-Forwarded-For $remote_addr;