[Feature] Refine BLOCKED_HEADERS to include proxy spoofing headers

[austinjump-sec]

In this pull request I added 'x-forwarded-for', 'x-forwarded-host', 'x-forwarded-proto', 'x-real-ip', 'cf-connecting-ip' to the BLOCKED_HEADERS in packages/cli-kit/src/public/node/graphiql/utilities.ts

WHY are these changes introduced?

Hardening the local GraphiQL utility against proxy-spoofing and host-header injection attacks.

Even though this tool runs locally, modern web browsers allow websites (or malicious extensions running in the user's browser) to make cross-origin requests to local ports (localhost:XXXX). If a malicious local script or browser tab sends forged proxy headers (X-Forwarded-For or cf-connecting-ip) to the GraphiQL endpoint, it could bypass internal IP whitelisting or hijack host-routing logic if the developer is routing their CLI through a tunnel (like Cloudflare or ngrok).

Refining the BLOCKED_HEADERS array brings this component in line with standard production-grade HTTP security best practices.

WHAT is this pull request doing?

Preventing proxy spoofing headers from being sent out from the CLI, this is a very minimalist change after observing potential insecurities in HTTP requests

Checklist

• I have touched no other code
• Refined the blocked_headers list to follow best-practice

[austinjump-sec]

I have signed the CLA!

[github-actions]

This PR seems inactive. If it's still relevant, please add a comment saying so. Otherwise, take no action.
→ If there's no activity within a week, then a bot will automatically close this.
Thanks for helping to improve Shopify's dev tooling and experience.

[austinjump-sec]

Waiting on checks

[github-actions]

This PR seems inactive. If it's still relevant, please add a comment saying so. Otherwise, take no action.
→ If there's no activity within a week, then a bot will automatically close this.
Thanks for helping to improve Shopify's dev tooling and experience.

[austinjump-sec]

waiting on checks