* fix: trim whitespace in parseIpFromHeaders to prevent IP banlist bypass
Fixes#29851
parseIpFromHeaders did not trim whitespace after splitting on comma
(or from array elements), so a padded x-forwarded-for header like
' 1.2.3.4 , 5.6.7.8' would fail an exact-match lookup against
IP_BANLIST, allowing a banned IP to bypass the check.
Added regression tests covering padded string, array, and an
end-to-end isIpInBanlist test reproducing the reported bypass.
* fix: address CodeRabbit review feedback
- Guard against undefined rawIp when parsing an empty header array
- Delete IP_BANLIST env var in test cleanup instead of assigning undefined
- Add regression test for empty array input to parseIpFromHeaders
* test: add regression test for tab/whitespace trimming in parseIpFromHeaders
