Fix misc findings from reaudit

[jclapis]

Work In Progress

This fixes several smaller miscellaneous findings from the reaudit assessment.

CBST2-01

• Added path / route to the JWT claims to improve resilience against replaying.

CBST2-04

• Added rate-limit flagging to admin route JWT auth checking.
• handle_reload() now updates the state atomically once all of the code has succeeded, and doesn't update it at all if any failures occur.

CBST2-06

• JWT auth checking now attempts to retrieve the rightmost client IP from various proxy forwarding headers, then the falls back to the direct connection IP.
• Fixed a race that occurred due to differing locks on JWT auth failure reads and writes. This was reverted due to performance considerations with locking the auth check for each request.
• (Done in Add a task to clean up expired JWT failure rate limits  #380) Added a task to periodically sweep and clean up expired JWT authorization failures.

CBST2-14

• Renamed a misnamed variable.

[ltitanb]

i dont think we should use tokio RwLock here, in general I'd much rather take a guard lock twice than hold it for long

[jclapis]

Discussed offline and reverted in a29a366 due to performance reasons.