fix: ip-address vulnerabilities

[arnaud-moncel]

Definition of Done

fix #1784

General

• Write an explicit title for the Pull Request, following Conventional Commits specification
• Test manually the implemented changes
• Validate the code quality (indentation, syntax, style, simplicity, readability)

Security

• Consider the security impact of the changes made

Note

Replace forest-ip-utils with Node's BlockList for IP whitelist checks

• Removes the forest-ip-utils dependency and replaces it with Node's built-in net.BlockList for IP allowlist enforcement in ip-whitelist.ts.
• IpWhitelist.bootstrap now builds an in-memory BlockList from configured rules, supporting single addresses, explicit ranges, and CIDR subnets for both IPv4 and IPv6.
• Malformed rules are caught and skipped with a Warn log rather than causing a bootstrap failure.
• IpWhitelist.checkIp now calls BlockList.check with an explicit IP version derived via net.isIPv6, rejecting requests with a Forbidden error when the IP is missing, invalid, or not in the allowlist.
• Behavioral Change: IP version is now explicitly determined per address; IPv4-mapped IPv6 addresses and compressed IPv6 notations are handled by the new implementation.

^{Macroscope summarized 5002a7b.}

[qltysh]

Coverage Impact

This PR will not change total coverage.

Modified Files with Diff Coverage (1)

Rating	File	% Diff	Uncovered Line #s
	packages/agent/src/routes/security/ip-whitelist.ts	100.0%
	Total	100.0%

🚦 See full report on Qlty Cloud »

🛟 Help

• Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.

• Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.

• File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)

  • Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.

[matthv]

LGTM