Add trusted proxy middleware and simplify clientip

Strip forwarded headers (Forwarded, X-Forwarded-For, X-Real-Ip)
from requests originating from untrusted proxies at the HTTP
server level, reusing the existing proxy-protocol trusted-proxies
config. The clientip package is now a pure extraction helper;
context plumbing and middleware wrappers are removed.

Signed-off-by: Émile Ré <emile@getprobo.com>

pkg/probod/probod.go

@@ -64,6 +64,7 @@ import (
 	"go.probo.inc/probo/pkg/probo"
 	"go.probo.inc/probo/pkg/securecookie"
 	"go.probo.inc/probo/pkg/server"
+	"go.probo.inc/probo/pkg/server/trustedproxy"
 	"go.probo.inc/probo/pkg/slack"
 	"go.probo.inc/probo/pkg/trust"
 	"go.probo.inc/probo/pkg/webhook"
@@ -768,6 +769,9 @@ func (impl *Implm) runApiServer(
 	ctx, span := tracer.Start(ctx, "probod.runApiServer")
 	defer span.End()
 
+	trustedProxies := parseIPs(impl.cfg.Api.ProxyProtocol.TrustedProxies)
+	handler = trustedproxy.NewMiddleware(trustedProxies)(handler)
+
 	apiServer := httpserver.NewServer(
 		impl.cfg.Api.Addr,
 		handler,