Fix a security issue with IP lock when is_proxy_used is set to True

We were using the first element of the list in the X-Forwarded-For HTTP
header as the client's IP address but, since most proxies just append to
it, the client is able to arbitrarily set a prefix. Therefore the
extracted IP address was unreliable and the IP lock insecure. Taking the
last element of that list fixes the issue.

Activating "is_proxy_used" when clients are allowed to directlty connect
to CWS remains as insecure as it always has been (i.e. a lot!).

This commit introduces a regression: a chain of multiple proxies isn't
supported anymore.
Add database constraint for Contest.start <= .stop
Make CWS select the language accoring to the HTTP specification
Allow IP lock to restrict login to whole subnets.
Accept authentic booleans (in addition to strings) in Yaml format
Fix some issues in cmscommon.mimetypes

Thanks to Fabian Gundlach (@fagu) for the reports.
Update message catalogs

Mark a few missed strings and run the generation commands again.
Improve unicode support
Improve the Base database entity
Improve AdminWebServer

Introduce helper methods to ease the parsing of arguments when creating
and updating contests, tasks and users. The simplification is huge!
Improve pylint score of AWS