Report receiver: don't log senders' addresses

The rate limit keeps addresses in memory, for at most a day; the log
lines don't need them, so the privacy policy can say they aren't stored.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/report-receiver/README.md

@@ -10,8 +10,9 @@ files each as an issue in the private Gitea repository
   so a report isn't lost if Gitea is down, and tries again every 10 minutes.
   Saved reports are deleted after 90 days; the Gitea issues stay.
 - It turns away more than 5 reports an hour or 20 a day from one address, and
-  more than 500 a day in all, and logs bigger than 10 MB compressed or 64 MB
-  uncompressed.
+  more than 500 a day in all. It keeps addresses for that in memory only, for
+  at most a day, and doesn't write them to its log. It also turns away logs
+  bigger than 10 MB compressed or 64 MB uncompressed.
 - `make test` in the repository runs `test_receiver.py`, which sends reports
   with the real `report` client to the receiver and a fake Gitea.
 

server/report-receiver/receiver.py

@@ -332,7 +332,8 @@ def make_handler(store, limiter):
             threading.Thread(target=store.deliver, args=(report_id,), daemon=True).start()
 
         def log_message(self, format, *args):
-            print(f"{self.client_address_seen()} {format % args}", file=sys.stderr, flush=True)
+            # Without the client's address: it's only kept, in memory, for the rate limit
+            print(format % args, file=sys.stderr, flush=True)
 
     return Handler