Add option to `node` preset for trusting `X-Forwarded-*` headers

Describe the feature

For deployment behind a reverse proxy one wants the receiving application to trust and use the X-Forwarded-For (and related) header set by the proxy. However, for edge deployments this is usually not desirable as they already provide the correct IP and attackers could provide false data in those headers. The runtime presets (node_*, bun, and deno) though are commonly deployed behind a reverse proxy and would thus benefit from an option to trust those headers and fill ServerRequest.ip with it's value.

A possible implementation would be to expose this as an environment variable like NITRO_TRUST_XFORWARDED=1 and/or a flag in defineConfig().

Cont'd from the discussion over at the h3 repo: https://github.com/h3js/h3/issues/1366#issuecomment-4588258740

Additional information

• Would you be willing to help implement this feature?

Start by tracing the node_* runtime presets, along with the bun and deno presets, and see how defineConfig() and ServerRequest.ip are wired. Review the related h3 discussion before choosing between NITRO_TRUST_XFORWARDED=1 and a configuration flag. Done means the selected option consistently controls whether X-Forwarded-* headers populate ServerRequest.ip across the supported presets.