* Change 'proxy_protocol' default mode and behavior
Now by default `proxy_protocol` is unspecified and in that mode
we don't allow IP pinned connections and mark incoming conection with setting
source port = 0.
'on' mode now requires PROXY header.
* Don't require PROXY headers for connection to itself.
There cases when Telelport will call itself and it can go directly,
avoiding load balancer, so connection will not have unsigned PROXY header.
* Refactor validation of 'proxy_protocol' input
* Clarify PROXY protocol modes description
* Tweak unexpected PROXY protocol line error message
* Add comments about setting port to 0
* Return an error if we get unsigned PROXY line after signed
* Improve wording for error when IP pinning is now allowed when source port = 0
* Add test for checking unspecified PROXY protocol mode on multiplexer
* Fix the test
* Refactor tracking of receiving of unsigned PROXY line.
It makes sure we don't allow multiple PROXY lines with LOCAL command.
* Improve comment wording.
* Fix typo and improve wording.
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Clarify PROXYProtocolMode description
* Add comment about self connections
* Set correct PROXYProtocolMode for multiplexers that don't need unsigned PROXY support
* Fix typo.
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Add comment about PROXY protocol mode on kube service.
* Clarify comment for starting auth service in unspecified PROXY protocol mode
* Add dedicated error for rejecting IP pinning on connection with port=0
* Improve error message
* Rate limit logging error about unexpected PROXY line.
* Tweak error message.
---------
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
