My Express application needs to trust the X-Forwarded-Proto and X-Real-IP headers only when they originate from the platform proxy. Which source IP addresses or CIDR blocks from the proxy are guaranteed and stable at the application socket level? If there is no such list, what trust configuration do you recommend, also taking into account access from private network services? Does the edge overwrite these two headers if sent by the client?