Avoid running the IPv6 regex on IPv4:port in normalizeIp

normalizeIp() called the version-less IPValidator.isIP(ip) first, which runs
the expensive IPv6 regex on every value that is not a bare IPv4 — including
IPv4:port forms that proxies routinely send in X-Forwarded-For / the peer
address. Since this runs in the per-request context constructor, it added
CPU on proxied traffic (introduced in #307).

Reorder normalizeIp to run the cheap structural checks before the version-less
isIP, keeping the same checks (and branch bodies) as zen-node's
getClientIpFromHeader: single-colon IPv4:port via isIP(host, "4"), then
bracketed IPv6 ([ipv6] / [ipv6]:port), and only then the version-less isIP as
the final fallback. node's isIP is native and cheap, ours is a regex, so the
only deviation from node is running isIP last instead of first.

Behavior is unchanged (existing ProxyForwardedParserTest suite passes; added
cases for multi-colon IPv4, IPv4:port short-circuit, bracketed IPv4 and
malformed "[::1]foo"). Verified with a JFR A/B on zen-demo-java under ip:port
traffic: total agent CPU 4.90% -> 4.41% (baseline before the regression 4.53%).

Author: dmitrii

agent_api/src/main/java/dev/aikido/agent_api/helpers/net/ProxyForwardedParser.java

@@ -55,17 +55,23 @@ private static String normalizeIp(String ip) {
 
         ip = ip.trim();
 
-        if (IPValidator.isIP(ip)) {
-            return ip;
+        // Some proxies pass along port numbers with IPv4 addresses: ip:port
+        if (ip.contains(":")) {
+            String[] ipParts = ip.split(":");
+            if (ipParts.length == 2 && IPValidator.isIP(ipParts[0], "4")) {
+                return ipParts[0];
+            }
         }
 
+        // Normalize IPv6 without port by removing brackets: [ipv6]
         if (ip.startsWith("[") && ip.endsWith("]")) {
             String unwrappedIp = ip.substring(1, ip.length() - 1);
             if (IPValidator.isIP(unwrappedIp)) {
                 return unwrappedIp;
             }
         }
 
+        // IPv6 with port: [ipv6]:port
         if (ip.startsWith("[")) {
             int closingBracket = ip.indexOf("]:");
             if (closingBracket > 0) {
@@ -76,12 +82,8 @@ private static String normalizeIp(String ip) {
             }
         }
 
-        // Some proxies pass along port numbers with IP addresses :
-        if (ip.contains(":")) {
-            String[] ipParts = ip.split(":");
-            if (ipParts.length == 2 && IPValidator.isIP(ipParts[0], "4")) {
-                return ipParts[0];
-            }
+        if (IPValidator.isIP(ip)) {
+            return ip;
         }
 
         return null;

agent_api/src/test/java/helpers/ProxyForwardedParserTest.java

@@ -214,4 +214,30 @@ void testGetIpFromRequest_RawIpWithEmptyStringFallsBackToRawIp() {
         String result = getIpFromRequest("", new HashMap<>());
         assertEquals("", result);
     }
+
+    @Test
+    void testGetIpFromRequest_IPv4WithMultiplePortColonsFallsBackToRawIp() {
+        headers.put("X-Forwarded-For", List.of("1.2.3.4:80:90"));
+        String result = getIpFromRequest("10.0.0.1", headers);
+        assertEquals("10.0.0.1", result);
+    }
+
+    @Test
+    void testGetIpFromRequest_IPv4PortResolvesWithoutTouchingLaterEntries() {
+        headers.put("X-Forwarded-For", List.of("203.0.113.7:54321, 8.8.8.8"));
+        String result = getIpFromRequest("10.0.0.1", headers);
+        assertEquals("203.0.113.7", result);
+    }
+
+    @Test
+    void testGetIpFromRequest_BracketedIPv4Resolves() {
+        String result = getIpFromRequest("[1.2.3.4]", new HashMap<>());
+        assertEquals("1.2.3.4", result);
+    }
+
+    @Test
+    void testGetIpFromRequest_BracketedIpWithTrailingGarbageFallsBackToRawIp() {
+        String result = getIpFromRequest("[::1]foo", new HashMap<>());
+        assertEquals("[::1]foo", result);
+    }
 }