Strip out the `Client-IP` header.

We don't use this header anywhere in our stack, using `X-Forwarded-For`
instead. If a request comes in with both headers set, and they don't
match, Rails will take this as evidence that someone is trying to spoof
their IP address to gain unauthorised access to something.

We could disable this check with a configuration change (see
https://github.com/alphagov/signonotron2/blob/a4c4c4ecc73a/config/application.rb#L64-69
for an example), but it's less likely to lead to bugs elsewhere in the
app if we strip out the `Client-IP` header entirely.  It's also simpler,
because it just requires  a single line in the `Gemfile` and doing the
dance of Bundler.
Merge pull request #470 from alphagov/strip-client-ips

Strip out the `Client-IP` header