Security fix for X-Forwarded-For HTTP header
Verify proxy client IP address

By verifying that the client IP (REMOTE_ADDR) is one of the trusted
proxies in our control, we can establish trust of the right-most IP in
X-Forwarded-For. Without this check, we have no way to verify that the
application is not receiving a direct request with a spoofed
X-Forwarded-For header.
Revert changes based on research

- http://en.wikipedia.org/wiki/X-Forwarded-For indicates "The last IP
  address is always the IP address that connects to the last proxy,
  which means it is the most reliable source of information." As such,
  the right-most IP after removing all trusted IPs should be used.

  Reverted changes after the first conditional inside
  `getIpAddressFromProxy()`, and added comments indicating the "why"
  behind the code choices.

- Updated tests to reflect the change.
Fixes #5254

Merge branch 'weierophinney-hotfix/5254'

* weierophinney-hotfix/5254:
  [#5254] Pre-process configuration to inject DB adapter instance
Added security announcement to README.md
Merge branch 'security/remote-address'

Security fix for `Zend\Http\PhpEnvironment\RemoteAddress`.

Fixes #5374
Merge branch 'security/remote-address' into develop

Forward port #5374 (`RemoteAddress` security fix)

Conflicts:
	README.md
[2.2.5] Release preparation

- Updated README.md with date of release
- Updated CHANGELOG.md with changelog for 2.2.5
- Upped Zend\Version\Version::VERSION to 2.2.5 (stable)
Merge branch 'releases/2.2.5'

2.2.5 readiness
Merge branch 'releases/2.2.5' into develop

2.2.5 readiness

Conflicts:
	README.md
	library/Zend/Version/Version.php
Bump to next development version

- 2.2.6dev
Merge branch 'version/bump' into develop

Next dev version

Conflicts:
	README.md
	library/Zend/Version/Version.php