Revert #9440 — volume admin fail-closed gate breaks multi-host clusters (#9472)

* Revert "volume: fail closed in admin gRPC gate when no whitelist is configured (#9440)"

This reverts commit 21054b6c18.

The fail-closed gate broke any multi-host cluster: in compose / k8s /
remote-host deployments the master's IP isn't loopback, so every
master->volume admin RPC (AllocateVolume, BatchDelete, EC reroute,
vacuum, scrub, ...) is rejected with PermissionDenied unless the
operator manually configures -whiteList. The e2e workflow has been
failing since 10cc06333 with `not authorized: 172.18.0.2` on
AllocateVolume; downstream symptom is fio fsync EIO because zero
volumes can be grown.

The gate's intent was to lock down destructive admin tooling, but the
same RPCs are the master's normal mechanism for growing and managing
volumes. Reverting to restore cluster-internal operation; a narrower
re-do should distinguish operator/admin callers from the master peer
(e.g. trust IPs resolved from -master) before going back in.

* security: skip invalid CIDR in UpdateWhiteList so IsWhiteListed can't panic

The revert in the previous commit also rolled back an unrelated bug fix
that lived inside #9440: UpdateWhiteList logged on net.ParseCIDR error
but did not continue, so the nil *net.IPNet was stored in whiteListCIDR
and IsWhiteListed would panic dereferencing cidrnet.Contains(remote) on
the next gRPC admin check.

Restore the continue. Orthogonal to the fail-closed semantics this PR
is reverting.

weed/command/scaffold/security.toml

@@ -198,11 +198,5 @@ kek = ""
 key = ""
 
 # white list. It's checking request ip address.
-# Destructive volume admin gRPCs (DeleteCollection, VolumeDelete,
-# VolumeMarkReadonly, VolumeMarkWritable, VolumeUnmount, VolumeMount,
-# VolumeServerLeave, AllocateVolume, VolumeConfigure, EC/vacuum) require a
-# populated white_list. If left empty, the volume server rejects those RPCs
-# from off-host peers (loopback callers are still trusted); either list the
-# admin IPs/CIDRs here or pass them via the -whiteList CLI flag.
 [guard]
 white_list = ""