fix(@angular/ssr): validate host headers to prevent header-based SSRF

fix(@angular/ssr): validate host headers to prevent header-based SSRF #26357