Exempt internal pod network (10.42.0.0/16) from the scanner-probe block

[Robbie1977]

What

Exempt trusted internal networks from the scanner-probe block in ha_api.security_middleware.

The middleware path-allowlists requests and 404s everything else as a "scanner probe", keyed on request.remote. In-cluster traffic arrives from the Rancher/Canal pod network (10.42.0.0/16) — the V3 cache, the frontend backend, and the post-release warmup tool — and was being caught and logged as probes.

• Adds _is_trusted_remote() + a TRUSTED_NETWORKS allowlist (default 10.42.0.0/16,127.0.0.0/8,::1/128, overridable via the TRUSTED_NETWORKS env var).
• Trusted in-cluster requests bypass the probe block and reach normal routing; an unknown path still 404s via the router, but is no longer counted or logged as a probe.

No change for external traffic — the allowlist + probe block still apply.

Verified

Unit-checked the matcher: 10.42.28.137, 10.42.250.176, 127.0.0.1, ::1 → trusted; 10.43.0.5, 192.168.1.5, 8.8.8.8, public IPs, None, and malformed strings → not trusted.