Use whole subnets in squid.php list for XFF acceptance

These new CIDR specs should cover all the infrastructure
subnets where we place Varnish and/or SSL proxies.  They
definitely cover all of the individual IPs being replaced
in this patch (and then some to save future pain).

The reason we don't use an even smaller list with broader
netmasks is that we *do* want to exclude things like networks
that contain labs hosts, etc.

Also, the entries for "singer" and ssl[1-4] were
removed, as these appear to not exist anymore.

This commit's deployment is a pre-requisite for:
https://gerrit.wikimedia.org/r/#/c/128089/

Change-Id: I5a2d86ef060b5b95412dbf42f8f955f3834aad8e