Add middleware to strip Client-IP headers

See alphagov/whitehall#810 for reasoning

/cc @bradleywright @alext