rproxy: remove every X-Forwarded- header from an untrusted peer (closes #325)

For a peer outside SWRP_TRUSTED_PROXIES, rproxy removed a fixed list of
traefik's forwarded headers, so names such as X-Forwarded-Ssl and
X-Forwarded-Scheme reached the app as the client sent them. An app that
reads them could take a plain request for a secure one. Now every header
whose name starts with X-Forwarded- is removed before rproxy sets its
three, and X-Real-IP as before. A trusted peer's headers pass on
unchanged.

Model: opus-5-5

internal/rproxy/client.go

@@ -105,17 +105,16 @@ func setForwardedHeaders(in, out *http.Request, peer netip.Addr, trusted bool) {
 		return
 	}
 
-	// ReverseProxy has removed Forwarded and the three set below; these are the
-	// other headers in which traefik tells the app about the visitor and its
-	// request.
-	for _, name := range []string{
-		"X-Forwarded-Port", "X-Forwarded-Server", "X-Forwarded-Uri",
-		"X-Forwarded-Method", "X-Forwarded-Prefix", "X-Forwarded-Tls-Client-Cert",
-		"X-Forwarded-Tls-Client-Cert-Info", "X-Real-Ip",
-	} {
-		out.Header.Del(name)
+	// ReverseProxy has removed Forwarded and the three set below. Go's server
+	// gives header names in canonical form, so the prefix matches any spelling.
+	for name := range out.Header {
+		if strings.HasPrefix(name, "X-Forwarded-") {
+			delete(out.Header, name)
+		}
 	}
 
+	out.Header.Del("X-Real-IP")
+
 	out.Header.Set("X-Forwarded-For", forwardedFor)
 	out.Header.Set("X-Forwarded-Host", in.Host)
 	out.Header.Set("X-Forwarded-Proto", "http")