add filter_private_ips option to discard private IPs.

Might be used when tracker is behind reverse proxy and one of provided
addresses in `real_ip_header` is private/local address.

Additional changes:

* check if provided address is not multicast/broadcast
* configure `http.Server.ReadHeaderTimeout` with `http.ReadTimeout` to mitigate Slowloris
* update dependencies
* minor docs fixes

frontend/http/frontend.go

@@ -214,10 +214,11 @@ func (f *Frontend) makeStopFunc(stopSrv *http.Server) stop.Func {
 // requests until Stop() is called or an error is returned.
 func (f *Frontend) serveHTTP(handler http.Handler, tls bool) error {
 	srv := &http.Server{
-		Handler:      handler,
-		ReadTimeout:  f.ReadTimeout,
-		WriteTimeout: f.WriteTimeout,
-		IdleTimeout:  f.IdleTimeout,
+		Handler:           handler,
+		ReadTimeout:       f.ReadTimeout,
+		ReadHeaderTimeout: f.ReadTimeout,
+		WriteTimeout:      f.WriteTimeout,
+		IdleTimeout:       f.IdleTimeout,
 	}
 
 	srv.SetKeepAlivesEnabled(f.EnableKeepAlive)