fix(security): resolve DoS vulnerability and rate limit bypass in badge rate limiter (#3120)

[desireddymohithreddy0925]

Summary

Optimizes the rate limiter's sliding window cleanup process to prevent CPU-based Denial of Service, and patches a bypass vulnerability caused by trusting spoofed client headers.

Closes #3120

---

Type of Change

• 🔒 Security fix
• ⚡ Performance improvement

---

What Changed

• Throttled the pruneStore execution in src/lib/badge-rate-limit.ts to run once per minute, preventing CPU exhaustion from full-map scans on every request.
• Removed blind trust of the x-forwarded-for header in getBadgeClientIp. Now prioritizes secure Edge/Vercel trusted IP headers and native connection IPs.

[github-actions]

GSSoC Label Checklist 🏷️

@Priyanshu-byte-coder — please apply the appropriate labels before merging:

Difficulty (pick one):

• level:beginner — 20 pts
• level:intermediate — 35 pts
• level:advanced — 55 pts
• level:critical — 80 pts

Quality (optional):

• quality:clean — ×1.2 multiplier
• quality:exceptional — ×1.5 multiplier

Validation (required to score):

• gssoc:approved — counts for points
• gssoc:invalid / gssoc:spam / gssoc:ai-slop — does not score

Type labels (type:*) are auto-detected from files and title. Review and adjust if needed.
Points formula: (difficulty × quality_multiplier) + type_bonus