Add middleware to strip Client-IP headers

`Client-IP` isn't required by our downstream servers as our web server layer is already setting `X-Forwarded-For` from the incoming TCP/IP connection. We get the client IP from this header.

However, some misconfigured routers (or indeed malicious users) will set `Client-IP` to an erroneous value, which causes Rails to blow up because of `ActionDispatch::RemoteIp::IpSpoofAttackError`.

This uses [alext/rack_strip_client_ip](https://github.com/alext/rack_strip_client_ip) by @alext to just remove the entire problematic header completely. This is best done within the Rails app itself as we're always fronted by a web-server layer in production, but only Rails suffers from this issue.