Add support for source IP auth behind a proxy

When using a proxy in front of your web server(s), the web server
sees the IP address of the proxy, and not the actual IP address of
the client making the requests.

This prevents you from using standard Apache directives to limit
access to a set of specific source IP addresses. While there are
Apache modules available that can help in this situation, we also
have the option of performing the access control within iNCIPit
itself.

This commit adds support for relying on the X-Forwarded-For HTTP
header to determine the actual IP of the client.

SECURITY NOTE: Your proxy MUST set/modify the X-Forwarded-For HTTP
header for this feature to work. If your proxy passes the header
unmodified, not only will your authorized clients likely be unable
to access the script, but unauthorized clients can easily spoof the
header to gain access.

To use, in the [access] section of iNCIPit.ini:

- set load_balancer_ip to the IP of your proxy
- set allowed_client_ips to a comma-delimited list of authorized IP
  addresses

If your proxy speaks to your backend servers via HTTP, you will also
need to set permit_plaintext to "yes" (case insensitive).  You must
then rely on your proxy to enforce the use of HTTPS, or trust your
authorized clients to always use HTTPS.

Signed-off-by: Jeff Godin <jgodin@tadl.org>