Security Advisory: NPM ip package still incorrectly identifies some private IP addresses as public

## Description

The problem described in CVE-2023-42282 is not completely fixed in v2.0.1 and v1.1.9. The `isPublic()` function still identifies some private IP addresses as public. This may lead to SSRF attacks if the `isPublic()`/`isPrivate()`/`isLoopback()` functions are used to guard outgoing network requests.

## PoC

See #143

- `127.1`, `127.0.1`, `127.00.0x1`, `127.0.0x0.1`
- `01200034567`
- `012.1.2.3`
- `fe80::0001`, `000:0:0000::01`, `000:0:0000:0:000:0:00:001`
- `::fFFf:127.0.0.1`

## Patches

No patch has been applied to the original package yet.

A patch has been proposed at #144.

## Suggestions

The `ip` package is not actively maintained. The author is not responsive.

Users of this package are advised to use alternative packages with similar functions even if their use of the `ip` package is not affected by this vulnerability, in order to get better support and avoid other potential vulnerabilities and bugs.

Alternatively, users may check their usage of the `isPublic()`/`isPrivate()`/`isLoopback()` functions to see if they are used to guard sensitive network requests (e.g. check whether the IP address provided in user input is private or public before sending out a request to it). Also follow the [Server Side Request Forgery Prevention - OWASP Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html). It's likely that even a correctly implemented `isPublic()` function is not enough to prevent SSRF attacks.

Reproduce the listed IPv4 and IPv6 cases from the issue, then inspect the implementations of isPublic(), isPrivate(), and isLoopback(). Review the reproduction referenced in #143 and the proposed patch in #144 before deciding on scope. Done means private or loopback addresses are not classified as public, with coverage for the reported forms.

Written by the indexing model from the issue text.