Add better access control to XDebug plugin

[zwoop]

The existing "ACL" mechanism is weak (obfuscating the header). Seeing that we've added a lot more information, some of which is sensitive, some which is computationally expensive, I feel strongly that we should add better ACL mechanisms ASAP. Being late in the game, I'm ok with postponing this until 9.1.x.

The suggestion would include

--allow=x-cache,x-cache-key

and

--deny=purge

And possibly,

--ip_allow=10.0.0.0-10.255.255.255 # or something like 10.0.0.0/8

We can discuss the default "allowed" fields here as well, but I think that x-cache alone is the one useful one. Also, bear in mind that a lot of this might be superseded with a new header in the future, Cache-Status:

https://tools.ietf.org/html/draft-ietf-httpbis-cache-header-02

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. Marking it stale to flag it for further consideration by the community.

[bryancall]

The core of this request, default-deny access control over which XDebug headers a client can request, was implemented in #9249 ("Add enable option to xdebug plugin"), first released in 10.0.0. All debug headers are now disabled by default and must be selectively enabled by the operator, for example "--enable=x-remap,x-cache", which mirrors the allow-list suggested here. If a client requests a header that has not been enabled, the plugin will not inject it. The optional IP allow-list idea was not added as a plugin option (IP-based gating can be handled in remap.config / ip_allow ahead of the plugin), but the main concern about sensitive and computationally expensive fields being exposed by default is addressed. Closing as resolved; please reopen or file a focused follow-up if the IP allow-list is still wanted.