Harden TUS upload Location rewriting against spoofed forwarded hosts

[Jugalsoni18]

Describe the bug/issue
Hi, I prepared a small hardening patch for the files TUS upload Location rewriting.

Branch:
https://github.com/Jugalsoni18/capgo/tree/fix/tus-location-hardening

Commit:
0741bca

Summary:

• Resolve files TUS upload Location base URLs from PUBLIC_URL/request origin in non-local environments instead of client-controlled X-Forwarded-Host.
• Keep forwarded host handling for local Supabase development.
• Add unit coverage for spoofed forwarded host, PUBLIC_URL preference, and local dev forwarding.

Tests:

• npx vitest run tests/files-tus-location.unit.test.ts
• npx eslint supabase/functions/_backend/files/supabaseTusProxy.ts tests/files-tus-location.unit.test.ts

I tried opening a PR, but GitHub shows that PR creation is limited to collaborators on this repository.