Merge #2703

2703: Paranoia: drop the headers we don't use r=mergify[bot] a=nextgens

## What type of PR?

enhancement

## What does this PR do?

Paranoia: drop the headers we don't use. This ensures there is no misunderstanding in between front and the other containers.

### Related issue(s)


## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [ ] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>

core/nginx/conf/proxy.conf

@@ -1,8 +1,9 @@
 # Default proxy setup
 proxy_set_header Host $http_host;
 proxy_set_header X-Real-IP $remote_addr;
-proxy_set_header True-Client-IP $remote_addr;
-proxy_set_header Forwarded "";
+proxy_hide_header True-Client-IP;
+proxy_hide_header CF-Connecting-IP;
+
 proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
 {% if REAL_IP_HEADER and REAL_IP_FROM %}
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -10,3 +11,17 @@ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_set_header X-Forwarded-For $remote_addr;
 {% endif %}
 proxy_http_version 1.1;
+proxy_hide_header Forwarded;
+proxy_hide_header X-Forwarded-Host;
+proxy_hide_header X-Forwarded-Server;
+proxy_hide_header X-Host;
+proxy_hide_header X-HTTP-Host-Override;
+
+proxy_hide_header X-Original-URL;
+proxy_hide_header X-Rewrite-URL;
+proxy_hide_header X-URL;
+
+proxy_hide_header X-HTTP-Method;
+proxy_hide_header X-HTTP-Method-Override;
+proxy_hide_header X-Method;
+proxy_hide_header X-Method-Override;