fix(ip): let a configured whitelist decide alone in the global and route IP stages

[rennf93]

Closes #87

I aligned the global and route IP list checks in IpSecurityCheck with the reference engine, where a configured whitelist decides alone and the blacklist applies only when no whitelist is configured.

• The global stage now runs the whitelist branch (which still sets isWhitelisted and skips the country stage on a match) and consults the blacklist only in the else arm.
• A configured route whitelist now skips the global lists for the request (the reference skip_ip_lists gate), still clearing the identity flags. The existing bin/test_geo_country.php assertion that pinned the old behavior now expects the route whitelist match to pass.
• checkRouteIpAccess now consults the route blacklist only when the route has no whitelist. The route country verdict still combines with it as before.

I added bin/test_ip_list_precedence.php with tests/data/ip_list_precedence.json, 100 rows (plus a 243-row route and global table, tests/data/ip_list_route_global.json) generated by running the reference (check_ip_access, check_route_ip_access): whitelist only, blacklist only, both with the IP in both, in neither, exact and CIDR forms and IPv4-mapped clients (evaluated after the canonical identity resolution the pipeline performs). The runner is registered in the Makefile and CI (including the coverage loop). On master 22 of its first 200 assertions fail (11 global, 11 route), and 24 of the 243 route and global rows fail on top of the precedence fix. php -l, composer validate --strict, every CI runner (against a private Redis), the 100% coverage gate and composer audit pass locally.