Accept the proxy user header only from trusted addresses

In proxy mode, each client that reached the port could send the user
header. PROXY_AUTH_TRUSTED_IPS now lists the addresses and networks that
can send it. The default is the loopback and private addresses, so a
request that comes straight from the internet cannot log in.

docker-compose.yml

@@ -23,8 +23,11 @@ services:
       # URL_BASE: /bindery
       # true only if clients reach Bindery through a reverse proxy alone. The login lockout then uses X-Forwarded-For.
       # TRUST_PROXY: "true"
+      # For AUTH_METHOD=proxy: the address of the proxy. The default trusts each private address.
+      # PROXY_AUTH_TRUSTED_IPS: 172.18.0.3
       # BINDERY_API_KEY: a-long-random-string
     ports:
+      # If a reverse proxy on this host is the only way in, publish the port only on the host: 127.0.0.1:8085:8085
       - 8085:8085
     restart: unless-stopped
     # /api/health needs no login, and works with and without URL_BASE.