refactor: replace express-ipfilter with lightweight custom middleware (#3917)

This fixes security issue
[CVE-2023-42282](https://github.com/advisories/GHSA-78xj-cgh5-2h22),
which is not very likely to be exploitable in MagicMirror² setups, but
still should be fixed.

The [express-ipfilter](https://www.npmjs.com/package/express-ipfilter)
package depends on the obviously unmaintained
[ip](https://github.com/indutny/node-ip) package, which has known
security vulnerabilities. Since no fix is available, this commit
replaces both dependencies with a custom middleware using the better
maintained [ipaddr.js](https://www.npmjs.com/package/ipaddr.js) library.

Changes:
- Add new `js/ip_access_control.js` with lightweight middleware
- Remove `express-ipfilter` dependency, add `ipaddr.js`
- Update `js/server.js` to use new middleware
- In addition, I have formulated the descriptions of the corresponding
tests a little more clearly.

js/server.js

@@ -3,12 +3,13 @@ const http = require("node:http");
 const https = require("node:https");
 const path = require("node:path");
 const express = require("express");
-const ipfilter = require("express-ipfilter").IpFilter;
 const helmet = require("helmet");
 const socketio = require("socket.io");
 const Log = require("logger");
 const { cors, getConfig, getHtml, getVersion, getStartup, getEnvVars } = require("#server_functions");
 
+const { ipAccessControl } = require(`${__dirname}/ip_access_control`);
+
 const vendor = require(`${__dirname}/vendor`);
 
 /**
@@ -84,17 +85,7 @@ function Server (config) {
 				Log.warn("You're using a full whitelist configuration to allow for all IPs");
 			}
 
-			app.use(function (req, res, next) {
-				ipfilter(config.ipWhitelist, { mode: config.ipWhitelist.length === 0 ? "deny" : "allow", log: false })(req, res, function (err) {
-					if (err === undefined) {
-						res.header("Access-Control-Allow-Origin", "*");
-						return next();
-					}
-					Log.log(err.message);
-					res.status(403).send("This device is not allowed to access your mirror. <br> Please check your config.js or config.js.sample to change this.");
-				});
-			});
-
+			app.use(ipAccessControl(config.ipWhitelist));
 			app.use(helmet(config.httpHeaders));
 			app.use("/js", express.static(__dirname));