IBX-11181: Filtered client-supplied X-Forwarded-* headers in Varnish VCL

[vidarl]

🎫 Issue	IBX-11181

Related PRs:

• IBX-11181: Trusted Proxies is not set on Ibexa Cloud core#699
• IBX-11181: Filtered client-supplied X-Forwarded-* headers in Varnish VCL post-install#108

Description:

Follow-up to ibexa/core#699, which makes Ibexa DXP declare the peer a trusted proxy when a request
arrives via Fastly on Ibexa Cloud. Once trusted proxies are in play, every X-Forwarded-* header a
client sends is believed by Symfony, so the VCL has to stop them from reaching the application.

Same change as ibexa/post-install#108, applied to the Upsun 5.0 VCL.

Per the Upsun header documentation the
router is authoritative for X-Forwarded-Proto, X-Client-IP and Client-Cdn, and discards
whatever the client sent for them. It says nothing about X-Forwarded-Host, X-Forwarded-Prefix or
RFC 7239 Forwarded, and states that it otherwise passes request headers through - so those three
arrive client controlled and are now stripped.

X-Forwarded-For needed more care. Without a CDN the router only appends the real client IP to
whatever the client sent, so every leading entry is client controlled. X-Client-IP is authoritative
in both the CDN and the non-CDN case, so it becomes the sole value of X-Forwarded-For. If it is
absent the request did not come through the router at all, and the header is dropped.

For QA:

Confirm on a real Upsun environment that a client supplied X-Forwarded-Host no longer reaches the
application, and that Client-Cdn: fastly from the router still does.