fix(host-detection): prefer user-defined NEXTAUTH_URL over automatic "forwardedHost" in Vercel environment

[jjorissen52]

This PR affects behavior that can only be observed in Vercel deployments.

The commit reverts behavior introduced by nextauthjs#3649, where the user-defined environment variable NEXTAUTH_URL is ignored in favor of the value of x-forwarded-host.

☕️ Reasoning

If a user deliberately sets a NEXTAUTH_URL environment variable, it means they wanted Vercel to use this as the canonical URL. next-auth should consider this deliberately defined value first and then fallback to automatic behavior otherwise. The current behavior, which is to use x-forwarded-host when available and fallback to user-defined NEXTAUTH_URL (on top of being surprising and not consistent with the documentation) breaks in multiple situations, including our current staging environment:

1. If a proxy sits between the user and the deployment on Vercel, wherein the actual site host and Vercel's deployment URL do no match, next-auth will end up using Vercel's deployment URL. For example, we have nginx listening at example.dev and our staging deployment at staging.example.com. Even though NEXTAUTH_URL=example.dev, next-auth sets redirect_uri to staging.example.com.
2. If you are using a Preview deployment, e.g. example.vercel.app, the current behavior is to set redirect_uri=<preview_url> which is practically guaranteed to not be whitelisted by your provider (since you can't know the auto-generated preview URL ahead of time).

🧢 Checklist

• Documentation consistent with existing
• Tests
• Ready to be merged (behavior tested locally)