fix(@angular/ssr): enforce explicit opt-in for proxy headers

[alan-agius4]

This commit introduces a secure-by-default model for trusting proxy headers (X-Forwarded-*) in the @angular/ssr package. Previously, the engine relied on complex lazy header patching and regex filters to guard against spoofed headers. However, implicit decoding behaviors by URL constructors can render naive regex filtering ineffective against certain percent-encoded payloads.

To harden the engine against Server-Side Request Forgery (SSRF) and header-spoofing attacks:

• Introduced the allowedProxyHeaders configuration option to AngularAppEngineOptions and AngularNodeAppEngineOptions.
• By default (false), all incoming X-Forwarded-* headers are aggressively scrubbed unless explicitly whitelisted via allowedProxyHeaders.
• Replaced the lazy cloneRequestAndPatchHeaders utility with a simplified, eager sanitizeRequestHeaders that centralizes the header scrubbing logic.
• Hardened verifyHostAllowed to definitively reject parsed hosts that successfully carry path, search, hash, or auth components, replacing previously fallible regex filters for stringently checked hosts.

BREAKING CHANGE:

The @angular/ssr package now ignores all X-Forwarded-* proxy headers by default. If your application relies on these headers (e.g., for resolving absolute URLs, trust proxy, or custom proxy-related logic), you must explicitly allow them using the new allowedProxyHeaders option in the application server configuration.

Example:

const engine = new AngularAppEngine({
  // Allow all proxy headers
  allowedProxyHeaders: true,
});

// Or explicitly allow specific headers:
const engine = new AngularAppEngine({
  allowedProxyHeaders: ['x-forwarded-host', 'x-forwarded-prefix'],
});