fix(middleware): log rejected CSRF requests with the trusted client address (#6692)

A panel or API request rejected for a missing or wrong CSRF token got a bare
403 and left nothing in the log, so an operator chasing failed logins from a
stale tab or a script had no trace. CSRFMiddleware now logs a warning with the
method, path and client address. The address comes from getRemoteIp, which
honours the trusted-proxy list, instead of gin's ClientIP, which trusts any
peer's X-Forwarded-For.

internal/web/controller/spa.go

@@ -33,7 +33,7 @@ func NewXUIController(g *gin.RouterGroup) *XUIController {
 func (a *XUIController) initRouter(g *gin.RouterGroup) {
 	g = g.Group("/panel")
 	g.Use(a.checkLogin)
-	g.Use(middleware.CSRFMiddleware())
+	g.Use(middleware.CSRFMiddleware(getRemoteIp))
 
 	g.GET("/", a.panelSPA)
 	g.GET("/inbounds", a.panelSPA)