Validate proxy IP headers and use SHA-256 for request fingerprinting

[ismailian]

Motivation

• Ensure source IP is not taken from forged or malformed proxy headers by validating header values before trusting them.
• Improve uniqueness and collision resistance of request fingerprints and make fingerprint generation more robust to non-array inputs.

Description

• Update ip() to trim and validate HTTP_CF_CONNECTING_IP, HTTP_X_REAL_IP, and the leftmost entry of HTTP_X_FORWARDED_FOR with filter_var(..., FILTER_VALIDATE_IP) and only return them when valid.
• Validate REMOTE_ADDR before returning and fall back to the literal '0.0.0.0' when it is missing or invalid.
• Harden fingerprint() by ensuring query and body are arrays before ksort, replace md5 calls with hash('sha256', ...) for query, body, json and the final fingerprint, and handle json_encode possibly returning false by defaulting to an empty string.

Testing

• Ran the existing test suite with phpunit, and all tests completed successfully.

---

Codex Task