2.1.7

fix(security): match IP rules against the one visitor address (2.1.7)

Allow and deny rules are now matched against request()->ip() only. This is
the address Laravel resolves through TRUSTED_PROXIES. Before, they were
matched against request()->ips(), which also returns every untrusted
address listed in X-Forwarded-For, including whatever the visitor wrote
there. A forged entry could then hit the localhost or allow-list branch,
even behind a correctly declared Cloudflare.

The rule lists are read through ipsAllow() / ipsDeny(). The README
(en/vi/ja) explains the Docker setting: never REMOTE_ADDR or *.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com