fix(@angular/ssr): introduce trustProxyHeaders option to safely validate and sanitize proxy headers

[alan-agius4]

…
This commit adds the trustProxyHeaders option to AngularAppEngineOptions and AngularNodeAppEngineOptions to configure, validate, and sanitize X-Forwarded-* headers.

• When trustProxyHeaders is undefined (default):
  • Allows X-Forwarded-Host and X-Forwarded-Proto.
  • Intercepts X-Forwarded-Prefix and triggers a dynamic CSR deoptimization to skip SSR if present.
  • Logs an informative message when receiving any other X-Forwarded-* headers.
• When false:
  • Ignores and strips all proxy headers from the request.
• When true:
  • Trusts all proxy headers.
• When a string array:
  • Allows only the proxy headers provided inside the array.

Example:

const engine = new AngularAppEngine({
  // Allow all proxy headers
  trustProxyHeaders: true,
});

// Or explicitly allow specific headers:
const engine = new AngularAppEngine({
  trustProxyHeaders: ['x-forwarded-host', 'x-forwarded-prefix'],
});

[gemini-code-assist]

Code Review

This pull request introduces the trustProxyHeaders configuration to AngularAppEngine, allowing for explicit control over which X-Forwarded-* headers are trusted during SSR. It replaces the previous header-patching approach with a more efficient sanitization process and adds a mechanism to deoptimize to CSR when certain proxy headers are present but untrusted. Review feedback suggests that the new VALID_PREFIX_REGEX is overly restrictive regarding dots in path segments and that the warning for unconfigured proxy headers should be adjusted to reduce log noise for default allowed headers.