Improve client IP detection

[cconard96]

Checklist before requesting a review

• I have read the CONTRIBUTING document.
• I have performed a self-review of my code.
• I have added tests that prove my fix is effective or that my feature works.
• This change requires a documentation update.

Description

Adds a new method of determining the client's IP address.

Currently, GLPI checks for some proxy-related headers first in some cases and then fall back to REMOTE_ADDR.

This pull request adds a more secure determination and HTTP headers could be spoofed by the client.

1. If GLPI is behind a reverse proxy (or several), the GLPI admin should add those IPs to the new GLPI_TRUSTED_REVERSE_PROXIES constant. They should additionally modify the new GLPI_REVERSE_PROXY_HEADERS constant to include the header used by their proxy(s) and only those headers.
2. GLPI will check REMOTE_ADDR against the trusted proxy IPs.
3. If the REMOTE_ADDR is a trusted proxy, only then will GLPI check the GLPI_REVERSE_PROXY_HEADERS in the order they were defined.
4. If the REMOTE_ADDR is not a trusted proxy, that value is assumed to be the client IP.

[Copilot]

Pull request overview

This PR introduces a new, centralized client IP detection utility intended to be safer when GLPI is deployed behind one or more reverse proxies, and updates several entry points to use it.

Changes:

• Added Glpi\Toolbox\IPUtilities::getClientIP() and new reverse-proxy configuration constants (GLPI_TRUSTED_REVERSE_PROXIES, GLPI_REVERSE_PROXY_HEADERS).
• Deprecated Toolbox::getRemoteIpAddress() and migrated API/auth/agent/middleware code paths to the new utility.
• Updated PHPStan constants configuration and changelog to reflect the new settings.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
src/Glpi/Toolbox/IPUtilities.php	New helper for client IP detection with reverse proxy support.
src/Toolbox.php	Deprecates legacy getRemoteIpAddress() in favor of IPUtilities.
src/Glpi/Application/SystemConfigurator.php	Adds default values for the new reverse-proxy constants.
src/Glpi/Api/API.php	Switches API client IP handling to IPUtilities.
src/Glpi/Api/HL/Middleware/IPRestrictionRequestMiddleware.php	Uses IPUtilities for OAuth client IP restriction checks.
src/Auth.php	Uses IPUtilities for login event IP logging.
src/Agent.php	Uses IPUtilities for agent remote address capture.
tests/functional/ToolboxTest.php	Adjusts test to avoid deprecation noise from the legacy method.
stubs/glpi_constants.php	Adds stubs for the new constants (for static analysis).
phpstan.neon.dist	Registers the new constants as dynamic for PHPStan.
CHANGELOG.md	Documents the improved client IP detection and new constants.