feat: #3419590 Let modules alter the allowed IP ranges

Adds hook_restrict_by_ip_ranges_alter() and type-specific variants so other modules can adjust each allow list before it is applied: the global login ranges, each user's ranges, and each role's ranges, including roles with no ranges configured. The decision stays in the module: an empty list after altering leaves the context unrestricted, a non-empty list restricts it to the listed ranges.

Also hardens the range check: malformed ranges (from alter hooks or not-yet-migrated legacy config) are treated as never matching instead of throwing, and the authenticated and anonymous pseudo-roles are never evaluated for role removal.

Coverage: 14 kernel tests for the alter contract via a test module, plus unit coverage for pseudo-role skipping and malformed range handling.

#ai-assisted