Test whether an IP address falls within a CIDR block. A well-formed address of a different family (or simply outside the block) returns contains=false — not an error.