Address ReDoS vulnerability in headers

[kitsonk]

Mitigate ReDoS vulnerability in x-forwarded-for and x-forwarded-proto header parsing by replacing regex with safer string operations and adding input bounds.

The previous regex-based splitting of x-forwarded-for and x-forwarded-proto headers could be vulnerable to ReDoS (Regular Expression Denial of Service) with crafted inputs. This PR replaces regex with simple split operations, adds length limits, and validates protocol values to prevent catastrophic backtracking and limit resource consumption.

---

[cursor]

Cursor Agent can help with this pull request. Just @cursor in comments and I'll start working on changes in this branch.
_{Learn more about Cursor Agents}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ kitsonk
❌ cursoragent
_{You have signed the CLA already but the status is still pending? Let us recheck it.}