www/nginx: make upstream client-address headers configurable

[EyJunge1]

Important notices

Before you submit a pull request, we ask you kindly to acknowledge the following:

• I have read the contributing guidelines at https://github.com/opnsense/plugins/blob/master/CONTRIBUTING.md
• I opened an issue first for non-trivial changes and linked it below.
• AI tools were used to create at least part of the code submitted herewith.

If AI was used, please disclose:

• Model used: Cursor Grok 4.5
• Extent of AI involvement: Assisted with implementation planning, model/form/template edits for the new Upstream options, and drafting this pull request text. Changes were reviewed and adjusted by the author.

---

Describe the problem

The www/nginx plugin hardcodes upstream client-address headers in location.conf (X-Real-IP, X-Forwarded-For via $proxy_add_x_forwarded_for, etc.). There is no GUI option to change or disable X-Forwarded-For, no control over RFC 7239 Forwarded, and provider headers such as CF-Connecting-IP / True-Client-IP are passed through unchanged.

With trusted proxies and real_ip_header, $remote_addr is the validated client address, but $proxy_add_x_forwarded_for can still preserve a client-supplied chain, and an unsanitized Forwarded header can be preferred by backends over X-Real-IP. Existing include hooks cannot safely replace these location-level proxy_set_header directives without duplicates.

---

Describe the proposed solution

Add Upstream advanced options next to the existing x_forwarded_host_verbatim setting:

• XFF: Mode — Append (default), Replace ($remote_addr), or Drop
• Forwarded: Mode — Preserve (default), Replace (sanitized RFC 7239 from $remote_addr + $scheme), or Drop
• Suppress CF-/True-Client-IP — clear those headers before proxying

Defaults keep the current behavior. Generated config emits at most one proxy_set_header per header name. RFC 7239 maps are only generated when an upstream uses Forwarded Replace.

---

Related issue

#5684