Strip out the `Client-IP` header

We don't use this header anywhere in our stack, using `X-Forwarded-For`
instead. If a request comes in with both headers set, and they don't
match, Rails will take this as evidence that someone is trying to spoof
their IP address to gain unauthorised access to something.

This is based on <https://github.com/alphagov/static/pull/470>.
Merge pull request #35 from alphagov/strip-client-ips

Strip out the `Client-IP` header