fix(zen): strip client IP/geo headers to prevent geoblock

[muhammadshehzaib]

Issue for this PR

Closes #40162
Closes #39831

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

This PR strips client-identifying geolocation, IP, and routing headers before proxying requests to upstream model providers (like OpenAI). Currently, if a user makes a request from a blocked region like Hong Kong, these headers are forwarded to the provider, causing the upstream request to fail with unsupported_country_region_territory (403). Removing these headers ensures requests appear to originate from the Zen server's own region.

How did you verify your code works?

I verified this behavior by running an isolated test script (verify_headers.js) that simulates the proxy's header-cloning and stripping logic.

• Without the changes: Geolocation headers (cf-connecting-ip, cf-ipcountry, true-client-ip, x-forwarded-for, etc.) remained present on the request headers object, causing geoblocking upstream.
• With the changes: All geoblocking headers were successfully deleted, leaving only the authorized API key header.

Screenshots / recordings

No UI changes.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

[github-actions]

Thanks for your contribution!

This PR doesn't have a linked issue. All PRs must reference an existing issue.

Please:

1. Open an issue describing the bug/feature (if one doesn't exist)
2. Add Fixes #<number> or Closes #<number> to this PR description

See CONTRIBUTING.md for details.

[github-actions]

Thanks for updating your PR! It now meets our contributing guidelines. 👍