CVE-2023-27591: Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics

The vulnerability stemmed from using client-controlled headers (X-Forwarded-For/X-Real-Ip) for access control checks in the metrics endpoint. The key vulnerable function is isAllowedToAccessMetricsEndpoint which performed the network containment check using the spoofable ClientIP value. FindClientIP is included as it provided the untrusted input. The patch moved to using FindRemoteIP (based on r.RemoteAddr) which can't be spoofed, confirming the original implementation's weakness. During exploitation, these functions would appear in call stacks when processing unauthorized metrics endpoint requests.