docs: add changelog and upgrading guide

Author: kenjis

user_guide_src/source/changelogs/v4.2.11.rst

@@ -9,6 +9,16 @@ Release Date: December 21, 2022
     :local:
     :depth: 2
 
+SECURITY
+********
+
+- *Attackers may spoof IP address when using proxy* was fixed. See the `Security advisory GHSA-ghw3-5qvm-3mqc <https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-ghw3-5qvm-3mqc>`_ for more information.
+
+BREAKING
+********
+
+- The ``Config\App::$proxyIPs`` value format has been changed. See :ref:`Upgrading Guide <upgrade-4211-proxyips>`.
+
 Bugs Fixed
 **********
 

user_guide_src/source/installation/upgrade_4211.rst

@@ -12,6 +12,23 @@ Please refer to the upgrade instructions corresponding to your installation meth
     :local:
     :depth: 2
 
+Breaking Changes
+****************
+
+.. _upgrade-4211-proxyips:
+
+Config\\App::$proxyIPs
+======================
+
+The config value format has been changed. Now you must set your proxy IP address and the HTTP header name for the client IP address pair as an array::
+
+    public $proxyIPs = [
+            '10.0.1.200'     => 'X-Forwarded-For',
+            '192.168.5.0/24' => 'X-Forwarded-For',
+    ];
+
+``ConfigException`` will be thrown for old format config value.
+
 Project Files
 *************