fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count

Impact The fix for CVE-2026-3635 GHSA-444r-cwp2-x5xf added a proxyFnsocket.remoteAddress, 0 guard on the X-Forwarded- reads in request.host, request.protocol, request.hostname, request.ip, and request.ips. That guard closes the IP, CIDR, and custom-function forms of trustProxy correctly because...