add a new configurable, PROXY_IP_WHITELIST

implement a whitelist setting that - if populated - will only allow
specific IPs/hostnames to provide custom REMOTE_HOST_HEADERS header
values (i.e., `HTTP_X_FORWARDED_FOR`)

see: #6538

awx/api/generics.py

@@ -98,6 +98,18 @@ class APIView(views.APIView):
         self.time_started = time.time()
         if getattr(settings, 'SQL_DEBUG', False):
             self.queries_before = len(connection.queries)
+
+        # If there are any custom headers in REMOTE_HOST_HEADERS, make sure
+        # they respect the proxy whitelist
+        if all([
+            settings.PROXY_IP_WHITELIST,
+            request.environ.get('REMOTE_ADDR') not in settings.PROXY_IP_WHITELIST,
+            request.environ.get('REMOTE_HOST') not in settings.PROXY_IP_WHITELIST
+        ]):
+            for custom_header in settings.REMOTE_HOST_HEADERS:
+                if custom_header.startswith('HTTP_'):
+                    request.environ.pop(custom_header, None)
+
         drf_request = super(APIView, self).initialize_request(request, *args, **kwargs)
         request.drf_request = drf_request
         return drf_request