Match the mapped form against blocked_networks only as IPv4

isBlockedIP again matches an IPv4-mapped address (::ffff:0:0/96) only
as the IPv4 address it holds, as on next: Go keeps a plain IPv4 address
in that form, so matching it as written let an IPv6 entry such as ::/0
refuse every IPv4 address. An IPv4-compatible address (::/96) is still
matched both as written and as the IPv4 address it holds.
ipv6AndIPv4Forms is gone. README.md says the mapped form is matched as
IPv4 only.

Model: opus-5-5

README.md

@@ -694,7 +694,10 @@ Key settings in more detail:
   and generator pages. Default: empty
 - `blocked_networks` — list of CIDR ranges to refuse for SSRF protection, added
   to the always-enforced built-in ranges (loopback, private, link-local, CGNAT,
-  benchmark, NAT64, and the like); an invalid CIDR aborts startup
+  benchmark, NAT64, and the like); an invalid CIDR aborts startup. An IPv6
+  address in the IPv4-mapped form (`::ffff:a.b.c.d`) is matched only as the IPv4
+  address it holds, so an IPv6 range such as `::/0` refuses neither it nor a
+  plain IPv4 address
 - `trusted_proxies` — list of CIDR ranges of the reverse proxies in front of
   pixa. `X-Forwarded-For` is believed only when the direct peer falls inside one
   of these ranges; the logged and login-recorded client address is then the