fix: strip client-supplied identity headers in LocalUserAuthMiddleware

Defensively remove HTTP_REMOTE_USER and HTTP_X_REMOTE_USER from the
WSGI environ before checking REMOTE_ADDR, preventing any client from
injecting identity headers that could be trusted by future code paths.

Author: YizukiAme

src/promptflow-devkit/promptflow/_sdk/_service/utils/local_user_auth.py

@@ -14,6 +14,10 @@ def __init__(self, wsgi_app):
         self._wsgi_app = wsgi_app
 
     def __call__(self, environ, start_response):
+        # Strip any client-supplied identity headers to prevent spoofing.
+        environ.pop("HTTP_REMOTE_USER", None)
+        environ.pop("HTTP_X_REMOTE_USER", None)
+
         if environ.get("REMOTE_ADDR") in _LOOPBACK_REMOTE_ADDRS:
             environ["REMOTE_USER"] = getpass.getuser()
         return self._wsgi_app(environ, start_response)