feat(server): add trustProxy option for X-Forwarded header support

[elohmeier]

Summary

When running Vite's dev server behind a reverse proxy (nginx, Caddy, etc.), the host validation middleware rejects requests because it validates against the proxy's internal hostname rather than the original client request host.

This PR adds a server.trustProxy option that, when enabled, extracts the original host from X-Forwarded-Host or RFC 7239 Forwarded headers for host validation.

Changes

• Add trustProxy to CommonServerOptions (defaults to false for security)
• Add getEffectiveHost() utility in new forwardedHeaders.ts module
• Update hostValidationMiddleware to use forwarded host when trustProxy is enabled
• Update WebSocket server host validation to use forwarded host
• Preview server inherits trustProxy from server config

Usage

// vite.config.js
export default {
  server: {
    trustProxy: true,
    allowedHosts: ['myapp.example.com'],
  },
}

Security Considerations

• The option is explicitly opt-in (false by default)
• Only enables trusting proxy headers when the user explicitly configures it
• Documentation notes that this should only be enabled when running behind a trusted reverse proxy

What is the purpose of this pull request?

• New feature

---

Additional context: This addresses a common deployment scenario where Vite runs behind a reverse proxy and DNS rebinding protection (introduced in recent versions) blocks legitimate requests because the Host header contains the internal proxy hostname rather than the public-facing hostname.