varnish: backends trust 127.0.0.1 for XFF

On beta the X-Fowarded-For and X-Fowarded-Proto fields are stripped by
the Varnish caches in sub vcl_recv. Pseudocode:

 acl allow_xff {
   # list of wikimedia networks missing 127.0.0.0/128
 }

 sub vcl_recv {
   if (client.ip ~ allow_xff ) {
     # Do nothing, aka keep X-Fowarded-Proto
   } else {
     set req.http.X-Fowarded-For = client.ip;
     unset req.http.X-Fowarded-Proto;
   }
 }

When a query is made on https://login.wikimedia.beta.wmflabs.org/ it
hits the nginx proxy which is local to the varnish frontend which itself
is local to the varnish backend. The 'X-Fowarded-For: https' header ends
up being stripped out and not passed to MediaWiki, the Apache backend
would thus redirect to the HTTPS url and ultimately cause a redirect
loop.

The two local networks are made available as $wikimedia_networks. Use it
to set the xff_source for all varnishes caches.


bug: 51700
Change-Id: I19a8f98e172aa3c9a0149de1c9b6f60271f34884
Merge "varnish: backends trust 127.0.0.1 for XFF" into production