Fixes entry condition in matomo proxy

[sgiehl]

Description

This fixes a whitelist bypass in matomo-proxy.php.

Previously, a request to the opt-out proxy was accepted if either the file parameter matched $VALID_FILES or module.action matched $SUPPORTED_METHODS. Because proxy.php prioritizes file for JS requests, an attacker could send a valid opt-out module.action together with an arbitrary file value and bypass the file whitelist.

The fix makes file take precedence: when a file parameter is present, it must be explicitly whitelisted. If no file is provided, the request must match one of the supported opt-out module.action pairs. Regression tests were added for both GET and POST variants of the mixed-parameter bypass.

Checklist

• [✔] I have understood, reviewed, and tested all AI outputs before use
• [✔] All AI instructions respect security, IP, and privacy rules

Review

• Functional review done
• Potential edge cases thought about (behaviour of the code with strange input, with strange internal state or possible interactions with other Matomo subsystems)
• Usability review done (is anything maybe unclear or think about anything that would cause people to reach out to support)
• Security review done
• Wording review done
• Code review done
• Tests were added if useful/possible
• Reviewed for breaking changes
• Developer changelog updated if needed
• New documentation added or existing documentation updated