Tinyproxy - Stathost Detection Bypass via Host Header Manipulation

An unauthenticated remote attacker can send an HTTP request to Tinyproxy with a `Host` header that matches the configured `stathost` (e.g., `Host: tinyproxy.stats`). Because the old code only checked the request URL's host field and used a flawed `strncmp` in the auth path, the attacker can trigger the stats page or have the request misclassified as a transparent proxy connection, bypassing access controls [ref_id=1]. The attacker needs only network access to the Tinyproxy listener; no authentication is required.

The vulnerability resides in `src/reqs.c` within the `process_request` and `handle_connection` functions. Prior to the patch, stathost detection only compared the request URL's host field using `strcmp`, ignoring the `Host` header entirely, and the `handle_connection` function used a prefix-based `strncmp` check that could be bypassed with a crafted Host header or port suffix.

The patch introduces a new `is_stathost` helper function that correctly compares a hostname (with optional trailing colon/port) against the configured stathost [patch_id=6466824]. It moves the stathost check to occur before the transparent proxy detection logic, so a request with a matching `Host` header is recognized as a stats request rather than being misrouted. The old `strncmp`-based check in `handle_connection` is replaced with the same robust helper, closing the prefix-match bypass.