Fix review comments on cookie banner API

Parse only the first IP from X-Forwarded-For to prevent
the full chain from bypassing anonymization. Add secondary
sort key for deterministic consent selection. Reject origins
with empty port suffix in the validator.

Signed-off-by: Émile Ré <emile@getprobo.com>

pkg/coredata/cookie_consent_record.go

@@ -223,7 +223,7 @@ WHERE
 	%s
 	AND cookie_banner_id = @cookie_banner_id
 	AND visitor_id = @visitor_id
-ORDER BY created_at DESC
+ORDER BY created_at DESC, id DESC
 LIMIT 1;
 `