fix: nil HTTP recorder ref in WebSocket goroutines, add tunnel loop detection

- handler/http/websocket, forwarder/sniffer_ws, sniffing/sniffer_ws: nil
  ro2.HTTP in WebSocket copy goroutines to avoid data races on the shared
  HTTP recorder object
- handler/tunnel/bind: remove ingress rule check that incorrectly
  overrode the endpoint host for non-matching ingress rules
- handler/tunnel/entrypoint: add forwarding loop detection by checking
  Gost-Forwarded-Node header for the entrypoint's own node ID

internal/util/forwarder/sniffer_ws.go

@@ -31,6 +31,7 @@ func (h *Sniffer) sniffingWebsocketFrame(ctx context.Context, rw, cc io.ReadWrit
 	go func() {
 		ro2 := &xrecorder.HandlerRecorderObject{}
 		*ro2 = *ro
+		ro2.HTTP = nil
 		ro := ro2
 
 		limiter := rate.NewLimiter(rate.Limit(sampleRate), int(sampleRate))
@@ -57,6 +58,7 @@ func (h *Sniffer) sniffingWebsocketFrame(ctx context.Context, rw, cc io.ReadWrit
 	go func() {
 		ro2 := &xrecorder.HandlerRecorderObject{}
 		*ro2 = *ro
+		ro2.HTTP = nil
 		ro := ro2
 
 		limiter := rate.NewLimiter(rate.Limit(sampleRate), int(sampleRate))