Potential X-Forwarded-For parsing improvements

I noticed a couple of potential issues which might be hard to debug, for people using RemoteAddr() functions.

1. It does not seem to me that this comparison in `context.go` should care about string case. (Some people might expect to be able to configure `X-FORWARDED-FOR` rather than `X-Forwarded-For` and expect the same functionality.)
```
if headerName == xForwardedForHeaderKey {
...
}
```
2. This is maybe something that could be corrected in server configurations outside of the library, but simply taking the first IP in the X-Forwarded-For list opens up client spoofing. The issue (and a potential solution) is explained in more detail at the bottom of this article: https://husobee.github.io/golang/ip-address/2015/12/17/remote-ip-go.html. (Their solution would also probably require new Configuration options allowing users to specify the private subnets they want excluded, though.)

Start in context.go at the headerName comparison and trace RemoteAddr() handling of X-Forwarded-For. Compare the current first-address behavior with the linked article’s trusted/private-subnet discussion. Done means the intended case handling and spoofing-resistant configuration are specified and covered by relevant tests.

Written by the indexing model from the issue text.