fix: honor accept_only_proxied_requests=False when known_networks is set

[sridhar-3009]

Summary

BaseForwardedHeadersMiddleware.should_validate_client_ip() combines its conditions like this:

return (
    self.accept_only_proxied_requests
    and any(self.known_proxies)
    or any(self.known_networks)
)

Since and binds tighter than or in Python, this is actually evaluated as:

(self.accept_only_proxied_requests and any(self.known_proxies)) or any(self.known_networks)

So whenever known_networks is configured (non-empty), the method returns True regardless of accept_only_proxied_requests - contradicting the method's own docstring:

If accept_only_proxied_requests is set to False, it means the server will accept both requests that are proxied and requests that are hitting the web server directly.

In practice, this means a server configured with known_networks=[...] and accept_only_proxied_requests=False (intending to accept both proxied and direct requests) will still validate the client IP against the known proxies/networks for every direct request, and reject any direct request whose IP isn't in that list with a 400 Proxy IP not recognized error - even though the developer explicitly asked for direct requests to be accepted too.

This doesn't reproduce when only known_proxies is used (the default), since in that case both terms of the or depend on accept_only_proxied_requests correctly. It's specific to the known_networks configuration.

Fix

Parenthesize the intended grouping:

return self.accept_only_proxied_requests and (
    any(self.known_proxies) or any(self.known_networks)
)

Test plan

• Reproduced the bug against main first (a direct, non-proxied request was rejected with 400 despite accept_only_proxied_requests=False) before applying the fix
• Added test_x_forwarded_headers_middleware_accepts_direct_requests_with_known_networks, covering the known_networks + accept_only_proxied_requests=False combination
• pytest tests/test_forwarding.py → 25 passed
• Full test suite: pytest tests/ → 1923 passed, 1 skipped
• black --check, isort --check-only, flake8 all clean on changed files