Issue #3283846: Store per-user IP ranges on the user entity instead of config

Max Pogonowskirequested to merge
issue/restrict_by_ip-3283846:3283846-store-per-user-ip into 9.x

Per-user IP restrictions now live on a restrict_by_ip_ranges base field on the user entity rather than in restrict_by_ip.settings. They travel with the user and no longer collide with configuration sync across environments. Role and global restrictions stay in config.

  • Add the base field (one CIDR range per line) with a CIDR-list validation constraint and a field-access check gated on 'administer restrict by ip'.
  • LoginFirewall reads the field; the service is now autowired.
  • hook_update_11401 installs the field storage on existing sites, and a post-update moves existing per-user config onto the field then drops the config key. Core installs and removes the field storage on install and uninstall, so no install/uninstall hook is needed.
  • Rework the per-user admin form to query the user entity instead of config.
  • Fix IPTools rejecting a /0 routing prefix; 0.0.0.0/0 is the valid match-any-address range.

Closes #3283846

Merge request reports