r.Header.Set simply overwrites the values.
The expected public IP should be the first public IP encountered.

When we use Header.Get only the first entry is fetched.

Per https://golang.org/src/net/http/request.go,
when there are multiple entries of the same header,
accessing the map directly allows us to get those
multiple entries in an array.

// Header contains the request header fields either received
// by the server or to be sent by the client.
//
// If a server received a request with header lines,
//
//	Host: example.com
//	accept-encoding: gzip, deflate
//	Accept-Language: en-us
//	fOO: Bar
//	foo: two
//
// then
//
//	Header = map[string][]string{
//		"Accept-Encoding": {"gzip, deflate"},
//		"Accept-Language": {"en-us"},
//		"Foo": {"Bar", "two"},

XFF can contain IP1,IP2,IP3
XFF can contain IP1, IP2 (note the space)

feat: Support multiple XFF headers