Security fix for X-Forwarded-For HTTP header
Verify proxy client IP address

By verifying that the client IP (REMOTE_ADDR) is one of the trusted
proxies in our control, we can establish trust of the right-most IP in
X-Forwarded-For. Without this check, we have no way to verify that the
application is not receiving a direct request with a spoofed
X-Forwarded-For header.
Revert changes based on research

- http://en.wikipedia.org/wiki/X-Forwarded-For indicates "The last IP
  address is always the IP address that connects to the last proxy,
  which means it is the most reliable source of information." As such,
  the right-most IP after removing all trusted IPs should be used.

  Reverted changes after the first conditional inside
  `getIpAddressFromProxy()`, and added comments indicating the "why"
  behind the code choices.

- Updated tests to reflect the change.
Added security announcement to README.md
Merge branch 'security/remote-address'

Security fix for `Zend\Http\PhpEnvironment\RemoteAddress`.

Fixes #5374
[2.2.5] Release preparation

- Updated README.md with date of release
- Updated CHANGELOG.md with changelog for 2.2.5
- Upped Zend\Version\Version::VERSION to 2.2.5 (stable)
Merge branch 'releases/2.2.5'

2.2.5 readiness
Bump to next development version

- 2.2.6dev
Merge branch 'version/bump'

Bump to next dev version (2.2.6dev)