Strip out the `Client-IP` header

We don't use this header anywhere in our stack, using `X-Forwarded-For` instead. If a request comes in with both headers set, and they don't match, Rails will take this as evidence that someone is trying to spoof their IP address to gain unauthorised access to something.

This is based on <https://github.com/alphagov/static/pull/470>.