[10.x] Update TrustProxies to rely on $headers if properly set

[inxilpro]

Right now the match statement in TrustProxies::getTrustedHeaderNames only handles single headers. This means that if you set TrustProxies::$headers to something like Request::HEADER_X_FORWARDED_FOR | Request::HEADER_X_FORWARDED_PORT it will ignore that and instead fall back on the default (which is to trust all headers).

There is a test for this, but the test was using the default values for TrustProxies::$headers, so it was passing because of the fallback, not because the it was working as expected.

The solution is to only rely on the match() statement if TrustProxies::$headers is not an integer. That way if someone has configured it correctly using bitmasks, it will respect the configuration, and only use string matching if the headers attribute is misconfigured.

This is a security issue and should be merged asap. Currently, anyone with custom TrustProxies headers that don't match the middleware defaults or the ELB/Traefik presets are impacted by this issue.

Until this PR is merged, anyone who is impacted can temporarily patch the bug by replacing the getTrustedHeaderNames method in TrustProxies with the following (this assumes that TrustProxies::$headers is properly set using the Request::HEADER_X_* constants):

protected function getTrustedHeaderNames()
{
  return $this->headers;
}