fix: nil HTTP recorder ref in WebSocket goroutines, add tunnel loop detection

- handler/http/websocket, forwarder/sniffer_ws, sniffing/sniffer_ws: nil
  ro2.HTTP in WebSocket copy goroutines to avoid data races on the shared
  HTTP recorder object
- handler/tunnel/bind: remove ingress rule check that incorrectly
  overrode the endpoint host for non-matching ingress rules
- handler/tunnel/entrypoint: add forwarding loop detection by checking
  Gost-Forwarded-Node header for the entrypoint's own node ID

handler/tunnel/bind.go

@@ -41,9 +41,7 @@ func (h *tunnelHandler) handleBind(ctx context.Context, conn net.Conn, network,
 	if host == "" || h.md.ingress == nil {
 		host = endpoint
 	} else if host != endpoint {
-		if rule := h.md.ingress.GetRule(ctx, host, ingress.WithService(h.options.Service)); rule != nil && rule.Endpoint != tunnelID.String() {
-			host = endpoint
-		}
+		host = endpoint
 	}
 	addr := net.JoinHostPort(host, port)