rproxy: remove every X-Forwarded- header from an untrusted peer (closes #325)

For a peer outside SWRP_TRUSTED_PROXIES, rproxy removed a fixed list of
traefik's forwarded headers, so names such as X-Forwarded-Ssl and
X-Forwarded-Scheme reached the app as the client sent them. An app that
reads them could take a plain request for a secure one. Now every header
whose name starts with X-Forwarded- is removed before rproxy sets its
three, and X-Real-IP as before. A trusted peer's headers pass on
unchanged.

Model: opus-5-5

SPEC.md

@@ -2315,8 +2315,9 @@ but for these headers:
   on.
 - For a peer outside `SWRP_TRUSTED_PROXIES`, its forwarded headers are its own
   claims and are replaced. `X-Forwarded-For` names the peer, `X-Forwarded-Host`
-  the host it asked for, and `X-Forwarded-Proto` plain `http`. The other headers
-  in which traefik tells an app about a visitor are removed.
+  the host it asked for, and `X-Forwarded-Proto` plain `http`. Every other
+  header whose name starts with `X-Forwarded-` is removed, and so are
+  `Forwarded` and `X-Real-IP`.
 - `X-Request-ID`, which carries the fresh id.
 - `X-Client-ASN` and `X-Client-Country`, which carry what `waf` answered. A
   header it did not give is left out. Any of the two the visitor sent is