Add toggle for proxy hosts to trust X-Forwarded-For headers

Is your feature request related to a problem? Please describe.

After a few tests, it looks like NPM automatically forwards X-Forwarded-For headers to the backend if already present. I'm unsure how safe it is to blindly pass this kind of information on. Some software does require knowing who originally sent the request, but I can't see a straightforward way to distinguish between spoofed headers and real ones. I would assume that best practice is for the front-facing proxy to drop headers of this kind (or maybe even the entire request since it probably is nefarious).

Describe the solution you'd like

A clear toggle to disable this behaviour seems adequate.

Describe alternatives you've considered

It can probably be configured within the advanced settings section.

Additional context

None.

Start at the proxy-host configuration and advanced-settings entry points, then trace how X-Forwarded-For is passed to upstream servers. Define where the toggle is stored and applied, and verify that disabling it prevents forwarding while existing proxy-host behavior remains unchanged. No specific files or tests are named in the issue.