Use the same validated client IP for settings and exclusions

[jdevalk]

Use one validated client-IP resolver for tracking exclusions and Add Current IP, so the address offered in settings is also the address checked on visits. Normalize IPv4/IPv6 before comparison and hide the button when no valid address is available.

Forwarded headers are no longer trusted automatically. Deployments should configure trusted proxies at the web server or use the documented simpleanalytics_client_ip filter after verifying the proxy. This intentionally changes behavior for installations that previously relied on unvalidated X-Forwarded-For values.

Fixes #40.

Validation: the WordPress regression fails on the original forwarded-header handling and passes with the fix, covering spoofed headers/chains, IPv6 equivalence, shared UI/filter behavior, malformed inputs and missing addresses. The existing Add Current IP browser test also passes. PHP syntax and diff checks pass.

Combined validation: all six proposed fixes were applied to a local integration branch; all 23 browser and WordPress regression tests, the asset build, PHP syntax checks and diff checks passed. GitHub workflows currently report action_required for these fork pull requests.

[adriaandotcom]

I made a change to this PR to preserve existing IP exclusions while making Add Current IP and the tracking check use the same address.

The plugin now:

• Uses the first address in X-Forwarded-For, when present.
• Otherwise uses REMOTE_ADDR.
• Validates and normalizes that address before checking the exclusion list.
• Treats an invalid forwarded address as no match, without falling back to the proxy’s address.

I considered checking both addresses, but that could exclude everyone behind a shared proxy. An address previously saved by “Add Current IP” might belong to the proxy; matching it as an additional candidate could suppress unrelated visitors’ analytics.

This preserves existing valid single-IP exclusions and adds support for forwarded IP chains, without requiring users to reconfigure working exclusions.

The plugin still relies on the proxy supplying trustworthy forwarded headers. Without those headers or server-side IP restoration, it cannot reliably identify the original visitor IP.

What do you think @jdevalk?