* fix(chaitin-waf): use trusted client IP source for WAF backend

The plugin populated `client_ip` sent to the Chaitin WAF backend by
reading `ctx.var.http_x_forwarded_for` directly when `real_client_ip`
is enabled, bypassing nginx's `real_ip` module. Any external client
could supply an arbitrary `X-Forwarded-For` header and have it
forwarded to the WAF unchecked.

Replace the raw-header read with `core.request.get_remote_client_ip`
(realip-aware) when `real_client_ip = true`, and `core.request.get_ip`
(direct TCP peer) when false. This applies the same fix shape used
for wolf-rbac in #13329.

* fix(chaitin-waf): preserve real_client_ip=false in get_conf merge

`get_conf` merged `real_client_ip` with `or`, which silently fell
back to the default `true` whenever the user explicitly set `false`,
making the toggle ineffective. Replace with an explicit nil check so
both `true` and `false` overrides are honored.

Also tighten the existing `real_client_ip = false` test to assert the
chosen `client_ip` (not just the response), and add a regression case
that verifies the `false` branch wins over `set_real_ip_from`-trusted
`X-Forwarded-For` rewrites.

* docs(chaitin-waf): clarify how real_client_ip selects the client IP

Describe the two `config.real_client_ip` modes in terms of the value
the plugin sends to the WAF service: APISIX's resolved client IP
(true) versus the IP of the directly connected peer (false). The
previous wording referenced only `X-Forwarded-For`, which no longer
matches the resolution path.

…#13329)

* fix(wolf-rbac): use trusted client IP source for access_check

The plugin previously read the raw `X-Real-IP` request header to populate
the `clientIP` parameter sent to wolf-server, falling back to
`core.request.get_ip` only if the header was absent. Reading the raw
header bypasses nginx's `real_ip` module, so any client could supply an
arbitrary value regardless of the configured `real_ip_from` trusted
proxy chain.

Switch to `core.request.get_remote_client_ip`, which returns
`$remote_addr` after `real_ip` processing — both correct when APISIX is
behind a trusted proxy and unspoofable from untrusted sources.

* test(wolf-rbac): assert clientIP respects trusted-proxy chain

Add regression coverage for the IP source change in wolf-rbac:

- Mock wolf-server now logs the `clientIP` query arg it receives, so
  tests can assert what the plugin forwarded.
- TEST 41: when the source is in `set_real_ip_from`, an `X-Real-IP`
  header is honored and forwarded to wolf-server.
- TEST 42: when the source is NOT in `set_real_ip_from`, a spoofed
  `X-Real-IP` is ignored and the actual peer address is forwarded.

* fix(wolf-rbac): also use trusted client IP in change_pwd log path

The same plugin still called `core.request.get_ip` for the missing-token
log line in `get_wolf_token`. It was non-spoofable but inaccurate behind
a trusted proxy, so two paths in one file resolved client IP differently.

Switch to `core.request.get_remote_client_ip` here as well so the whole
plugin uses one consistent source.

…e#13339)

* fix(chaitin-waf): use trusted client IP source for WAF backend

The plugin populated `client_ip` sent to the Chaitin WAF backend by
reading `ctx.var.http_x_forwarded_for` directly when `real_client_ip`
is enabled, bypassing nginx's `real_ip` module. Any external client
could supply an arbitrary `X-Forwarded-For` header and have it
forwarded to the WAF unchecked.

Replace the raw-header read with `core.request.get_remote_client_ip`
(realip-aware) when `real_client_ip = true`, and `core.request.get_ip`
(direct TCP peer) when false. This applies the same fix shape used
for wolf-rbac in apache#13329.

* fix(chaitin-waf): preserve real_client_ip=false in get_conf merge

`get_conf` merged `real_client_ip` with `or`, which silently fell
back to the default `true` whenever the user explicitly set `false`,
making the toggle ineffective. Replace with an explicit nil check so
both `true` and `false` overrides are honored.

Also tighten the existing `real_client_ip = false` test to assert the
chosen `client_ip` (not just the response), and add a regression case
that verifies the `false` branch wins over `set_real_ip_from`-trusted
`X-Forwarded-For` rewrites.

* docs(chaitin-waf): clarify how real_client_ip selects the client IP

Describe the two `config.real_client_ip` modes in terms of the value
the plugin sends to the WAF service: APISIX's resolved client IP
(true) versus the IP of the directly connected peer (false). The
previous wording referenced only `X-Forwarded-For`, which no longer
matches the resolution path.