fix(@angular/ssr): enforce explicit opt-in for proxy headers

[alan-agius4]

This commit introduces a secure-by-default model for trusting proxy
headers (X-Forwarded-*) in the @angular/ssr package. Previously, the
engine relied on complex lazy header patching and regex filters to guard
against spoofed headers. However, implicit decoding behaviors by URL
constructors can render naive regex filtering ineffective against certain
percent-encoded payloads.

To harden the engine against Server-Side Request Forgery (SSRF) and
header-spoofing attacks:

• Introduced the allowedProxyHeaders configuration option to
  AngularAppEngineOptions and AngularNodeAppEngineOptions.
• By default (false), all incoming X-Forwarded-* headers are aggressively
  scrubbed unless explicitly whitelisted via trustProxyHeaders.
• Replaced the lazy cloneRequestAndPatchHeaders utility with a simplified,
  eager sanitizeRequestHeaders that centralizes the header scrubbing logic.
• Hardened verifyHostAllowed to definitively reject parsed hosts that successfully
  carry path, search, hash, or auth components, replacing previously fallible
  regex filters for stringently checked hosts.

BREAKING CHANGE:

The @angular/ssr package now ignores all X-Forwarded-* proxy headers by default. If your application relies on these headers (e.g., for resolving absolute URLs, trust proxy, or custom proxy-related logic), you must explicitly allow them using the new trustProxyHeaders option in the application server configuration.

Example:

const engine = new AngularAppEngine({
  // Allow all proxy headers
  trustProxyHeaders: true,
});

// Or explicitly allow specific headers:
const engine = new AngularAppEngine({
  trustProxyHeaders: ['x-forwarded-host', 'x-forwarded-prefix'],
});

[gemini-code-assist]

Code Review

This pull request implements support for trusting and sanitizing proxy headers (X-Forwarded-*) in the Angular SSR engine. It introduces a new configuration option to specify allowed proxy headers, replaces the request cloning/patching logic with a more performant sanitization utility, and enhances the validation of host and prefix headers. Review feedback identifies a critical naming inconsistency between 'trustProxyHeaders' and 'allowedProxyHeaders' across the public API and various modules, a property access error in the Node engine implementation, and a minor optimization for header name normalization.