core/gateway: set x-forwarded headers

[fredr]

related to #1926

[encore-cla]

All committers have signed the CLA.

[Copilot]

Pull Request Overview

Adds X-Forwarded-* header propagation to the HTTP proxy so upstream services see original client IP, host, and protocol.

• Set X-Forwarded-For by appending client IP to any existing header
• Propagate incoming Host as X-Forwarded-Host
• Insert X-Forwarded-Proto based on request scheme

Comments suppressed due to low confidence (2)

runtimes/core/src/api/gateway/mod.rs:327

• Add unit/integration tests to verify that X-Forwarded-For, X-Forwarded-Host, and X-Forwarded-Proto headers are correctly inserted, appended, or removed under various session conditions.

// Set X-Forwarded-* headers, based on https://cs.opensource.google/go/go/+/refs/tags/go1.24.3:src/net/http/httputil/reverseproxy.go;l=78

runtimes/core/src/api/gateway/mod.rs:340

• [nitpick] Ensure insert_header replaces existing values rather than appending; if it appends, explicitly remove the old x-forwarded-for header first to avoid duplicate entries.

upstream_request.insert_header("x-forwarded-for", combined)?;