Add middleware to strip Client-IP headers

We don't use Client-IP for anything, and it causes Rails to throw 500s
if a downstream router sets these headers wrongly, because of
`ActionDispatch::RemoteIp::IpSpoofAttackError`.