fix(@angular/ssr): validate host headers to prevent header-based SSRF [LTS 20]

[alan-agius4]

This change introduces strict validation for Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port headers in the Angular SSR request handling pipeline, including CommonEngine and AngularAppEngine.

Previously, the application engine constructed the base URL for server-side rendering using these headers without validation. This could allow an attacker to manipulate the headers to steer relative HttpClient requests to arbitrary internal or external hosts (SSRF).

With this change:

• The Host and X-Forwarded-Host headers are validated against a strict allowlist.
• localhost and loopback addresses (e.g., 127.0.0.1, [::1]) are allowed by default.
• X-Forwarded-Port must be numeric.
• X-Forwarded-Proto must be http or https.
• Requests with invalid or disallowed headers will now be rejected with a 400 Bad Request status code.

BREAKING CHANGE:

Server-side requests will now fail with a 400 Bad Request error if the Host header does not match a customized allowlist (or localhost).

AngularAppEngine Users:
To resolve this, you must configure the allowedHosts option in your angular.json to include all domain names where your application is deployed.

Example configuration in angular.json:

"architect": {
  "build": {
    "options": {
      "security": {
        "allowedHosts": ["example.com", "*.trusted-example.com"]
      }
    }
  }
}

CommonEngine Users:
If you are using CommonEngine, you must now provide the allowedHosts option when initializing or rendering your application.

Example:

const commonEngine = new CommonEngine({
  allowedHosts: [“example.com”, “*.trusted-example.com"]
});