fix: panic on full-width IP-SUFFIX rules

[AaronChen0]

IPSuffix.Match panics with index out of range [-1] when a rule uses a full-byte suffix such as IP-Suffix,1.2.3.4/32 and a connection's address matches that suffix exactly.

When bits%8 == 0, the full-byte loop already validated the entire suffix, so the sub-byte check is unnecessary (and the << 8 shift would be a no-op anyway).

To reproduce the panic:

1. Add - IP-SUFFIX,1.1.1.1/32,DIRECT to your first rule.
2. Run curl 1.1.1.1.

[wwqgtxx]

It might look better to place the conditions on a single line, joined by &&.

[AaronChen0]

Sure.

[wwqgtxx]

Your current submission contains compilation errors; please revise it.

[AaronChen0]

Fixed.

[AaronChen0]

The 1 failed test on windows seems unrelated to this pull request.

[wwqgtxx]

Don't worry, we will merge them later when we have time.