WordPressVIPMinimum.Variables.ServerVariables.UserControlledHeaders wrong & incomplete

1) I get 1) WordPressVIPMinimum.Variables.ServerVariables.UserControlledHeaders even when it's perfectly fine sanitized:

`$user_ip = filter_var( $_SERVER['HTTP_X_FORWARDED_FOR'], FILTER_VALIDATE_IP );`

or with wp only functions (though I'm not sure if it really is properly sanitized then)

`sanitize_text_field( wp_unslash( $_SERVER['HTTP_X_FORWARDED_FOR'] ) )`

What is the correct way of validating this this sniff expects?

2) this error doesn't make much sense, as it's limited to 3 headers. But there is an arbitrary number of HTTP headers the client could send which would not trigger this error but may be used.
E.g. when using cloudflare there's also the CF_IPCOUNTRY,... headers which would also need to be added to the check.

首先定位 sniff WordPressVIPMinimum.Variables.ServerVariables.UserControlledHeaders，并使用报告中的两个 PHP 示例重现其行为。调查它如何识别验证，以及检查哪些客户端标头，然后确定定义预期行为的测试或 fixture。完成的标准是：验证指导和标头覆盖范围已明确并经过验证。

由索引模型根据 Issue 内容生成。