FR: Support X-Forward headers for trusted proxies

### What is the issue?

For services, the X-Forwarded-* headers (For, Host, and Proto but not Port) get overridden by the reverse proxy inside Tailscale. I have a public-facing reverse proxy that uses the service feature to access services on my tailnet. When I use a service (instead of referencing a server and port directly), I lose the original request's host header.

This creates issues when I have applications with SSO configured because they do not know the correct host to use when constructing callback URLs.

### Steps to reproduce

1. Set up a simple logging server on a host on the tailnet (I used `nc -l -p 22000`)
2. Configure a service in the admin console named `test`
3. Run `tailscale serve --service=svc:test --https=22000 localhost:22000` on the host with netcat running
4. Approve the configuration in the console
5. Set up a reverse proxy (I use Caddy) to map `test.example.com` to `test.example.ts.net:22000` and `test-direct.example.com` to `host.example.ts.net:22000`
6. Make a request to `test.example.com` and see that the `X-Forwarded-Host` output from `nc` is `test.example.ts.net:22000`
7. Restart netcat
8. Make a request to `test-direct.example.com` and see that the `X-Forwarded-Host` output from `nc` is `test-direct.example.com`.

Here is what mine looks like.

### Are there any recent changes that introduced the issue?

This has been happening for a while.

### OS

Linux

### OS version

Pop!_OS 24.04 and 22.04, Debian 12 and 13

### Tailscale version

1.96.4

### Other software

Caddy

### Bug report

BUG-83b82000dacfa4d9edf4f13097faa05dcb860d806c762a94be43a531d8176ea5-20260513163002Z-68c3260036e7ce3f