Fix artwork webserver IP allowlist bypass over IPv6

[clevervi]

Closes #1256

While reading through the custom models component I noticed the artwork webserver only enforces its player-IP allowlist for IPv4 connections. The pre-routing handler checks AF_INET against allowedIPs_, but the AF_INET6 branch was just an empty // TODO: Add IPV6 support, so any request coming in over IPv6 skipped the check entirely and got served.

Since allowedIPs_ is only ever populated with the IPv4 address of connected players (allowIPAddress takes a uint32_t, and onPlayerConnect passes networkID.address.v4), an IPv6 client can never legitimately be on the allowlist anyway. In practice that meant the restriction was silently bypassed and anyone could pull every .txd/.dff the server hosts just by requesting over IPv6.

This makes the handler deny by default: only allowlisted IPv4 requests get through, everything else gets a 401. It closes the bypass without pretending to add IPv6 allowlisting — doing that properly would need the map and allowIPAddress/onPlayerConnect to actually track v6 addresses, which I'm happy to do as a follow-up if you'd prefer that route.

The fix stands on the current behaviour alone: allowedIPs_ only ever holds IPv4 addresses, so an IPv6 request can never legitimately be in it and should be denied rather than served.

For context, this also looks like it lines up with the behaviour before the sockaddr refactor in 9cbf0f9: back then the handler ran getpeername and cast the result to sockaddr_in unconditionally, so a non-IPv4 peer would have been run through the IPv4 allowlist check anyway and, not being in it, denied. When the check was split into explicit AF_INET / AF_INET6 branches, the empty IPv6 branch started falling through to return Unhandled. I haven't verified the old path at runtime, so treat that part as context rather than the reason for the change — the point is just to deny by default while IPv6 allowlisting stays a TODO.

Worth noting: IPv6 players couldn't download custom models before this change either (they were never added to the allowlist), so this doesn't remove any working behaviour — it just makes the denial explicit instead of accidentally allowing everyone.