Backport of the v3 fix (1403cc8, PR #4260) for GHSA-gcfq-8gqf-4876 /
CVE-2026-45045 to the v2 branch: Header.Add kept an attacker-supplied
X-Real-IP as the first header value, so upstream servers reading the
first value trusted the spoofed IP. Header.Set overwrites it with the
real client IP (c.IP()).

Adds the corresponding regression test adapted to v2's *fiber.Ctx
handler signature, and fixes the same insecure pattern in the proxy
middleware doc example.

…g job

The v2 test matrix has been red on newer Go versions and non-Linux
platforms. Root causes are systemic and cannot be fixed by CI config alone
without taking the flaky bits out of the merge gate:

- The suite has pre-existing flaky data races (e.g. the package-global
  fiber.Get client in Test_Client_UserAgent) and order-dependent tests. A
  -race abort (os.Exit) fails the whole run; neither the old
  nick-fields/retry nor gotestsum's per-test rerun-fails can mask it (and
  gotestsum additionally refuses to rerun because the recover test prints a
  literal "panic:" via debug.Stack, which it treats as a suspected panic).
- The current macos-latest runners (macOS 26, arm64) abort binaries built
  by Go <= 1.23 with "dyld: missing LC_UUID load command", so v2's entire
  supported Go range fails to even launch its test binaries there.

Changes:

- Blocking Build job runs `go test ./... -count=1` (no -race, no -shuffle;
  -shuffle exposes the order-dependent tests) under nick-fields/retry, which
  has no panic heuristic to trip over.
- Add a separate non-blocking Race job (continue-on-error) running
  `go test -race -shuffle=on` so the pre-existing races stay visible without
  blocking merges. Fold -race back into Build once they are fixed (#4496
  fixes the first one).
- Raise the matrix floor to Go 1.20 to match the module's go.mod (go 1.20).
- Drop macOS from the matrix: v2's Go range cannot run on the macOS 26
  runners (dyld/LC_UUID). ubuntu and windows cover the matrix.
- Add fail-fast: false and explicit job timeouts.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The repo has CodeQL "default setup" enabled, so the advanced
codeql-analysis.yml workflow's SARIF upload is rejected on every run with
"CodeQL analyses from advanced configurations cannot be processed when the
default setup is enabled", leaving a permanently red "Analyse" check on
every v2 PR. The main branch already removed this workflow for the same
reason; default setup keeps scanning, so there is no loss of coverage.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CodeQL flagged that the workflow does not restrict the GITHUB_TOKEN. Both
jobs only check out the repo and run tests, so contents: read is sufficient
(matches the v3 test workflow).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Two pre-existing issues in middleware/proxy made v2 CI red under
`go test -race` on newer Go versions and Windows:

1. Data race: Test_Proxy_Forward_WithTlsConfig called WithTlsConfig(),
   which mutates the field client.TLSConfig on the package-global client
   with no synchronization against fasthttp's concurrent read of that
   field from parallel proxy tests. Swap the whole global client via
   WithClient(&fasthttp.Client{TLSConfig: ...}) instead (pointer swap
   under the existing lock), mirroring the v3 fix. The public
   WithTlsConfig API is left untouched.

2. Flaky timing: Test_Proxy_DoDeadline_PastDeadline used a 1s DoDeadline
   deadline equal to app.Test's default 1000ms timeout, so two coincident
   timers raced. Bump the deadline to 2s so app.Test's timeout fires
   first deterministically (same approach as v3).

Test-only change, no production or API changes. Verified 12/12 green
with `-race -shuffle=on`.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

fix(proxy) + ci: fix proxy data race and get the v2 CI green

The *_WithSetParserDecoder tests (and Test_Ctx_BodyParser_IndexTooLarge)
call the package-global SetParserDecoder() with a custom ParserConfig but
never restore the default. Because they run in the serial phase, the mutated
global decoder leaks into the parallel Test_Ctx_QueryParser /
Test_Ctx_ReqHeaderParser tests, which then decode with the wrong config and
fail. Normal source order happened to hide it; go test -shuffle exposes it
deterministically (and it is why the -race CI job was red).

Restore the package default (IgnoreUnknownKeys: true, ZeroEmpty: true) via
defer in each mutating test. Verified 5x green under
`go test . -run 'Test_Ctx_(QueryParser|ReqHeaderParser|BodyParser)' -race -shuffle=on`
and across shuffle seeds that previously failed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

test(ctx): restore global parser decoder after SetParserDecoder tests (fixes shuffle/-race flakes)

…orward-x-real-ip

🐛 fix(proxy): backport BalancerForward X-Real-IP overwrite fix to v2