Make GeoIP lookup code safer

* geo_init() now checks that the value returned by GeoIP_open() is non-null.
* Because geo_sanitize_for_cookie() modifies its input, it is no longer called
  on GeoIPRecord struct members.
* geo_get_xff_ip() has been repurposed into geo_get_relevant_ip(), and does not
  use strtok_r, which is not thread-safe.
* geo_get_addr_family() (which called getaddrinfo) was removed in favor of the
  crude but sufficiently reliable test of strchr(ip, ':') != NULL for IPv6.
* The cookie domain (which is derived from the host header on the client
  request) is sanitized via geo_sanitize_for_cookie() before being included in
  the cookie.

Bug: 64582
Change-Id: Ie4c7fd6511158f377592c305ee2108f0a9f36bfb