Rate-limit bypass via spoofed client IP

Rate-limit bypass in Lemmy before 0.19.19 and 1.0.0-beta.1 allows remote attackers to evade request throttling via X-Forwarded-For. In crates/utils/src/rate_limit/mod.rs, raw_ip_key uses actix-web ConnectionInfo::realip_remote_addr, which trusts the first X-Forwarded-For value; Lemmy's bundled nginx config appends the real client address after any client-supplied value with $proxy_add_x_forwarded_for, so the attacker controls the rate-limit bucket key. Unauthenticated requests through the default reverse-proxy path are enough to rotate spoofed addresses across registration, login, posting, comment, search, image-upload, and import endpoints, enabling brute-force attempts, spam, scraping, and excess uploads without compromising code execution or stored data.