Support team locked out of cluster-admin HTTP route

[nrauso]

In issue #7312, we introduced the ability to restrict web UI access based on a list of allowed IPs or networks.

However, this change has introduced a regression affecting support sessions: if a sysadmin restricts the cluster-admin route to specific IPs or networks, it becomes inaccessible via the support session.

This occurs because the access restriction may unintentionally exclude the loopback IP of the NS8 instance, which is required to reach the UI during a support session.

To resolve this, the loopback address of the instance should be implicitly included in the allowed IPs when access restrictions are in place.

Components

• core:3.6.4

[nrauso]

While working on this issue, @DavidePrincipi suggested trying an SSH port redirection to access the API server on port 9311.
With this setup, the UI becomes reachable, but it's unusable due to a broken WebSocket connection:

This likely happens because the browser attempts to use TLS on a non-encrypted port.

EDIT:
A good workaround for now is to add the loopback address to the ipAllowList section in the cluster-admin dynamic configuration fragment of traefik.

[DavidePrincipi]

In Testing 3.7.1-dev.1

Test case 1

Check that with the testing version, pointing the browser to 127.0.0.1:9311 (api-server) returns a working cluster-admin UI.

Additional test case

The PR NethServer/ns8-core#872 needs an additional verification. Promote to leader a worker node of a two nodes cluster and check that the UI no longer pops up empty toast notifications.